--os-release--
NAME="Amazon Linux"
VERSION="2023"
ID="amzn"
ID_LIKE="fedora"
VERSION_ID="2023"
PLATFORM_ID="platform:al2023"
PRETTY_NAME="Amazon Linux 2023.8.20250818"
ANSI_COLOR="0;33"
CPE_NAME="cpe:2.3:o:amazon:amazon_linux:2023"
HOME_URL="https://aws.amazon.com/linux/amazon-linux-2023/"
DOCUMENTATION_URL="https://docs.aws.amazon.com/linux/"
SUPPORT_URL="https://aws.amazon.com/premiumsupport/"
BUG_REPORT_URL="https://github.com/amazonlinux/amazon-linux-2023"
VENDOR_NAME="AWS"
VENDOR_URL="https://aws.amazon.com/"
SUPPORT_END="2029-06-30"
--id--
uid=0(root) gid=0(root) groups=0(root)
--pwd--
/
--uname--
Linux wazuh.manager 6.8.0-117-generic #117-Ubuntu SMP PREEMPT_DYNAMIC Tue May  5 19:26:24 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
--capabilities-pid1--
CapInh:	0000000000000000
CapPrm:	00000000a80425fb
CapEff:	00000000a80425fb
CapBnd:	00000000a80425fb
CapAmb:	0000000000000000
--environment--
API_PASSWORD=WazuhPass123!
API_USERNAME=wazuh-wui
FILEBEAT_SSL_VERIFICATION_MODE=full
HISTCONTROL=ignoredups
HISTSIZE=1000
HOME=/root
HOSTNAME=
INDEXER_PASSWORD=SecretPassword
INDEXER_URL=https://wazuh.indexer:9200
INDEXER_USERNAME=admin
LOGNAME=root
MAIL=/var/spool/mail/root
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PWD=/
SHLVL=1
SSL_CERTIFICATE=/etc/ssl/filebeat.pem
SSL_CERTIFICATE_AUTHORITIES=/etc/ssl/root-ca.pem
SSL_KEY=/etc/ssl/filebeat.key
USER=root
_=/usr/bin/env
--listeners--
bash: line 16: ss: command not found
bash: line 16: netstat: command not found
  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode
   0: 00000000:D6D8 00000000:0000 0A 00000000:00000000 00:00000000 00000000   999        0 170270374 1 0000000000000000 100 0 0 10 0
   1: 0B00007F:A353 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 170258453 2 0000000000000000 100 0 0 10 0
   2: 00000000:05EA 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 170281187 1 0000000000000000 100 0 0 10 0
   3: 00000000:05EB 00000000:0000 0A 00000000:00000000 00:00000000 00000000     0        0 170264002 1 0000000000000000 100 0 0 10 0
   4: 0A0014AC:05EA 190014AC:BAB9 01 00000000:00000000 02:000002B1 00000000   999        0 170473408 2 0000000000000000 20 4 31 10 -1
   5: 1E0214AC:05EA 0A0214AC:AF11 01 00000000:00000000 02:000000F8 00000000   999        0 170311774 2 0000000000000000 20 4 31 10 -1
   6: 0A0014AC:E4B2 0C0014AC:23F0 01 00000000:00000000 00:00000000 00000000     0        0 170276456 1 0000000000000000 20 4 32 10 -1
   7: 1E0214AC:05EA 0A0214AC:DC49 01 00000000:00000000 02:0000074C 00000000   999        0 170523723 2 0000000000000000 20 4 31 10 -1
   8: 0A0014AC:05EA 230014AC:DBF7 01 00000000:00000000 02:000009DD 00000000   999        0 170315112 2 0000000000000000 20 4 28 10 -1
   9: 0A0014AC:05EA 240014AC:ED57 01 00000000:00000000 02:0000052C 00000000   999        0 170315110 2 0000000000000000 20 4 31 10 -1
  10: 0A0014AC:BB44 DC281568:01BB 08 00000000:00000019 00:00000000 00000000     0        0 301266612 1 0000000000000000 20 4 30 10 -1
  11: 0A0114AC:05EA 140114AC:B9DF 01 00000000:00000000 02:000008B0 00000000   999        0 170305965 2 0000000000000000 21 4 31 10 -1
  12: 0A0014AC:A86A 0C0014AC:23F0 01 00000000:00000000 00:00000000 00000000     0        0 261477446 1 0000000000000000 20 4 30 10 -1
  13: 0A0014AC:9256 0C0014AC:23F0 01 00000000:00000000 00:00000000 00000000     0        0 170474810 1 0000000000000000 20 4 30 10 -1
  14: 0A0014AC:9C68 0C0014AC:23F0 01 00000000:00000000 02:00000216 00000000     0        0 170287447 2 0000000000000000 20 4 30 24 91
  15: 0A0014AC:E4A8 0C0014AC:23F0 01 00000000:00000000 00:00000000 00000000     0        0 170266390 1 0000000000000000 20 4 32 10 -1
  16: 1E0214AC:05EA 0C0214AC:CB73 01 00000000:00000000 02:000009F7 00000000   999        0 170301947 2 0000000000000000 20 4 31 10 -1
   sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode ref pointer drops
38278: 0B00007F:BFAD 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 170258452 2 0000000000000000 0
55259: 00000000:0202 00000000:0000 07 00000000:00000000 00:00000000 00000000     0        0 170279966 2 0000000000000000 0
--network-addresses--
bash: line 18: ip: command not found
--routes--
bash: line 20: ip: command not found
--dns--
# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.

nameserver 127.0.0.11
search tail18b785.ts.net
options edns0 trust-ad ndots:0

# Based on host file: '/etc/resolv.conf' (internal resolver)
# ExtServers: [host(127.0.0.53)]
# Overrides: []
# Option ndots from: internal
--hosts--
127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::	ip6-localnet
ff00::	ip6-mcastprefix
ff02::1	ip6-allnodes
ff02::2	ip6-allrouters
172.20.1.10	wazuh.manager wazuh
172.20.2.30	wazuh.manager wazuh
172.20.0.10	wazuh.manager wazuh
--hostname--
wazuh.manager
--mounts--
--users--
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin
wazuh:x:999:999::/var/ossec:/sbin/nologin
--groups--
root:x:0:
bin:x:1:
daemon:x:2:
sys:x:3:
adm:x:4:
tty:x:5:
disk:x:6:
lp:x:7:
mem:x:8:
kmem:x:9:
wheel:x:10:
cdrom:x:11:
mail:x:12:
man:x:15:
dialout:x:18:
floppy:x:19:
games:x:20:
tape:x:33:
video:x:39:
ftp:x:50:
lock:x:54:
audio:x:63:
users:x:100:
nobody:x:65534:
wazuh:x:999:wazuh
--process-tree--
    PID    PPID USER     COMMAND
      1       0 root     s6-svscan -t0 /var/run/s6/services
     38       1 root     s6-supervise s6-fdholderd
    568       1 wazuh    /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
    569     568 wazuh    /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
    570     568 wazuh    /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
    573     568 wazuh    /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
    576     568 wazuh    /var/ossec/framework/python/bin/python3 /var/ossec/api/scripts/wazuh_apid.py
    600       1 wazuh    /var/ossec/bin/wazuh-integratord
    621       1 root     /var/ossec/bin/wazuh-authd
    635       1 wazuh    /var/ossec/bin/wazuh-db
    649       1 root     /var/ossec/bin/wazuh-execd
    664       1 wazuh    /var/ossec/bin/wazuh-analysisd
    690       1 root     /var/ossec/bin/wazuh-syscheckd
    704       1 wazuh    /var/ossec/bin/wazuh-remoted
    705       1 wazuh    /var/ossec/bin/wazuh-remoted
    926       1 root     /var/ossec/bin/wazuh-logcollector
    945       1 wazuh    /var/ossec/bin/wazuh-monitord
    955       1 root     /var/ossec/bin/wazuh-modulesd
   1603       1 root     s6-supervise ossec-logs
   1605       1 root     s6-supervise filebeat
   1607    1603 root     /usr/bin/coreutils --coreutils-prog-shebang=tail /usr/bin/tail -F /var/ossec/logs/ossec.log
   1608    1605 root     /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
 141007       0 root     bash -lc    set +e   echo --os-release--   cat /etc/os-release   echo --id--   id   echo --pwd--   pwd   echo --uname--   uname -a   echo --capabilities-pid1--   grep "^Cap" /proc/1/status || true   echo --environment--   env | sort   echo --listeners--   (ss -lntup || netstat -lntup || cat /proc/net/tcp /proc/net/udp || true) 2>&1   echo --network-addresses--   ip addr show 2>&1 || true   echo --routes--   ip route show table all 2>&1 || true   echo --dns--   cat /etc/resolv.conf   echo --hosts--   cat /etc/hosts   echo --hostname--   cat /etc/hostname   echo --mounts--   mount | sed -n "1,240p"   echo --users--   getent passwd | sed -n "1,240p"   echo --groups--   getent group | sed -n "1,260p"   echo --process-tree--   ps -eo pid,ppid,user,args || true
 141045  141007 root     ps -eo pid,ppid,user,args
