Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I and just installed OSSEC and it is telling this

Process '2517' hidden from /proc. Possible kernel level rootkit.
Excessive number of hidden processes. It maybe a false-positive or something really bad is going on.

Its my live server and i host around 20 sites on it.

How can i remove that. and what maximum damage it can do

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

Do you see that hidden process every time you run OSSEC? If you see it only once, it could be that there was a delay between when OSSEC got the info from ps (say) and then it checked it against /proc. In the meanwhile the process may have terminated, raising the alert you just saw.

share|improve this answer
add comment

It would probably be a good thing to install and run rkhunter. If this confirms that you have been compromised then your only realistic action is to make a copy of the compromised server to analyse later then reinstall from scratch and recover using known good backups.

share|improve this answer
add comment

It might be that OSSEC is using the unhide utility to check for hidden processes. This tool sometimes raises false-positives.

You can check yourself by running unhide proc or unhide-linux26 proc for a 64bit system.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.