Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a few EC2/Scalr instances with zabbix monitoring. I received complaints about one of my servers port scanning other servers. the logs show it is accessing port 22 on consecutive IP addresses.

I looked at the processes list and saw scanssh is running under the user Zabbix.

My question is- Is scanssh part of zabbix? Is it suppesd to run? I have active autodiscovery on zabbix but it is looking at another IP addresses and definately not port 20. Is it possible that something in the config of zabbix agent is controlling it and not the settings on zabbix server?

What can I do to find out if zabbix is somehow misbehaving or it is a hacker? Any advice is highly appreciated.

share|improve this question
up vote 3 down vote accepted

scanssh is definitely not a part of zabbix - it is actually a separate ssh scanner (

it looks like your zabbix user account has been compromised. wipe the account and set it up anew using a different password (if you used one, of course). it might be also helpful to figure out which version of zabbix exactly are you running

share|improve this answer

This might be due to a SQL Injection problem in <1.8.1

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.