Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I and just installed OSSEC and it is telling this

Process '2517' hidden from /proc. Possible kernel level rootkit.
Excessive number of hidden processes. It maybe a false-positive or something really bad is going on.

Its my live server and i host around 20 sites on it.

How can i remove that. and what maximum damage it can do

share|improve this question
up vote 1 down vote accepted

Do you see that hidden process every time you run OSSEC? If you see it only once, it could be that there was a delay between when OSSEC got the info from ps (say) and then it checked it against /proc. In the meanwhile the process may have terminated, raising the alert you just saw.

share|improve this answer

It would probably be a good thing to install and run rkhunter. If this confirms that you have been compromised then your only realistic action is to make a copy of the compromised server to analyse later then reinstall from scratch and recover using known good backups.

share|improve this answer

It might be that OSSEC is using the unhide utility to check for hidden processes. This tool sometimes raises false-positives.

You can check yourself by running unhide proc or unhide-linux26 proc for a 64bit system.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.