UNIT FILE                              STATE           VENDOR PRESET
apt-daily-upgrade.service              static          -
apt-daily.service                      static          -
autovt@.service                        alias           -
binfmt-support.service                 enabled         enabled
console-getty.service                  enabled-runtime disabled
container-getty@.service               static          -
cryptdisks-early.service               masked          enabled
cryptdisks.service                     masked          enabled
dbus-org.freedesktop.hostname1.service alias           -
dbus-org.freedesktop.locale1.service   alias           -
dbus-org.freedesktop.login1.service    alias           -
dbus-org.freedesktop.resolve1.service  alias           -
dbus-org.freedesktop.timedate1.service alias           -
dbus-org.freedesktop.timesync1.service alias           -
dbus.service                           static          -
debug-shell.service                    disabled        disabled
dmesg.service                          disabled        enabled
dpkg-db-backup.service                 static          -
e2scrub@.service                       static          -
e2scrub_all.service                    static          -
e2scrub_fail@.service                  static          -
e2scrub_reap.service                   disabled        enabled
emergency.service                      static          -
falco-custom.service                   disabled        enabled
falco-kmod-inject.service              static          -
falco-kmod.service                     disabled        enabled
falco-modern-bpf.service               enabled         enabled
falco.service                          alias           -
falcoctl-artifact-follow.service       disabled        enabled
fstrim.service                         static          -
getty-static.service                   static          -
getty@.service                         disabled        enabled
hwclock.service                        masked          enabled
initrd-cleanup.service                 static          -
initrd-parse-etc.service               static          -
initrd-switch-root.service             static          -
initrd-udevadm-cleanup-db.service      static          -
kmod-static-nodes.service              static          -
kmod.service                           alias           -
logrotate.service                      static          -
modprobe@.service                      static          -
motd-news.service                      static          -
networkd-dispatcher.service            disabled        enabled
procps.service                         alias           -
quotaon.service                        static          -
rc-local.service                       static          -
rc.service                             masked          enabled
rcS.service                            masked          enabled
rescue.service                         static          -
reverse-tools-install.service          enabled         enabled
rsyslog.service                        enabled         enabled
serial-getty@.service                  disabled        enabled
ssh.service                            enabled         enabled
ssh@.service                           static          -
sshd.service                           alias           -
sudo.service                           masked          enabled
syslog.service                         alias           -
system-update-cleanup.service          static          -
systemd-ask-password-console.service   static          -
systemd-ask-password-wall.service      static          -
systemd-backlight@.service             static          -
systemd-binfmt.service                 static          -
systemd-bless-boot.service             static          -
systemd-boot-check-no-failures.service disabled        disabled
systemd-boot-system-token.service      static          -
systemd-exit.service                   static          -
systemd-fsck-root.service              static          -
systemd-fsck@.service                  static          -
systemd-fsckd.service                  static          -
systemd-halt.service                   static          -
systemd-hibernate-resume@.service      static          -
systemd-hibernate.service              static          -
systemd-hostnamed.service              static          -
systemd-hybrid-sleep.service           static          -
systemd-initctl.service                static          -
systemd-journal-flush.service          static          -
systemd-journald.service               static          -
systemd-journald@.service              static          -
systemd-kexec.service                  static          -
systemd-localed.service                static          -
systemd-logind.service                 static          -
systemd-machine-id-commit.service      static          -
systemd-modules-load.service           static          -
systemd-network-generator.service      disabled        enabled
systemd-networkd-wait-online.service   disabled        disabled
systemd-networkd.service               disabled        enabled
systemd-poweroff.service               static          -
systemd-pstore.service                 disabled        enabled
systemd-quotacheck.service             static          -
systemd-random-seed.service            static          -
systemd-reboot.service                 static          -
systemd-remount-fs.service             enabled-runtime enabled
systemd-resolved.service               enabled         enabled
systemd-rfkill.service                 static          -
systemd-suspend-then-hibernate.service static          -
systemd-suspend.service                static          -
systemd-sysctl.service                 static          -
systemd-sysext.service                 disabled        enabled
systemd-sysusers.service               static          -
systemd-time-wait-sync.service         disabled        disabled
systemd-timedated.service              static          -
systemd-timesyncd.service              enabled         enabled
systemd-tmpfiles-clean.service         static          -
systemd-tmpfiles-setup-dev.service     static          -
systemd-tmpfiles-setup.service         static          -
systemd-update-utmp-runlevel.service   static          -
systemd-update-utmp.service            static          -
systemd-user-sessions.service          enabled         enabled
systemd-volatile-root.service          static          -
user-runtime-dir@.service              static          -
user@.service                          static          -
wazuh-agent.service                    enabled         enabled
x11-common.service                     masked          enabled

113 unit files listed.
--service-status--
● reverse-tools-install.service - Install Reverse Engineering Tools Lab Services on First Boot
     Loaded: loaded (/etc/systemd/system/reverse-tools-install.service; enabled; vendor preset: enabled)
     Active: active (exited) since Mon 2026-06-15 05:45:17 UTC; 2min 56s ago
    Process: 41 ExecStart=/opt/purple-team/scripts/install-all.sh (code=exited, status=0/SUCCESS)
   Main PID: 41 (code=exited, status=0/SUCCESS)
        CPU: 7min 37.121s

Jun 15 05:45:17 reverse-host install-all.sh[3861]:   - strings - Extract strings from binaries
Jun 15 05:45:17 reverse-host install-all.sh[3861]:   - yara - Pattern matching engine
Jun 15 05:45:17 reverse-host install-all.sh[3861]:   - FLOSS - Advanced string analysis
Jun 15 05:45:17 reverse-host install-all.sh[3861]:   - CAPA - Capability analysis
Jun 15 05:45:17 reverse-host install-all.sh[3861]:   - hexdump - Hex viewer
Jun 15 05:45:17 reverse-host install-all.sh[3861]:   - upx - Packer/unpacker
Jun 15 05:45:17 reverse-host install-all.sh[3861]:   - osslsigncode - Code signing verification
Jun 15 05:45:17 reverse-host install-all.sh[3861]: Workspace: /home/labadmin/reverse-workspace
Jun 15 05:45:17 reverse-host install-all.sh[3861]: Quick start: 'analyze <binary_file>'
Jun 15 05:45:17 reverse-host systemd[1]: Finished Install Reverse Engineering Tools Lab Services on First Boot.

● rsyslog.service - System Logging Service
     Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-06-15 05:40:30 UTC; 7min ago
TriggeredBy: ● syslog.socket
       Docs: man:rsyslogd(8)
             man:rsyslog.conf(5)
             https://www.rsyslog.com/doc/
   Main PID: 34 (rsyslogd)
      Tasks: 4 (limit: 23154)
     Memory: 1.6M
        CPU: 605ms
     CGroup: /system.slice/docker-444305b37e671af013d8f2e64cca4909dd3dd2d084ce41348974586e7fcfd227.scope/system.slice/rsyslog.service
             └─34 /usr/sbin/rsyslogd -n -iNONE

Jun 15 05:40:30 reverse-host systemd[1]: Starting System Logging Service...
Jun 15 05:40:30 reverse-host rsyslogd[34]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd.  [v8.2112.0]
Jun 15 05:40:30 reverse-host rsyslogd[34]: rsyslogd's groupid changed to 106
Jun 15 05:40:30 reverse-host systemd[1]: Started System Logging Service.
Jun 15 05:40:30 reverse-host rsyslogd[34]: rsyslogd's userid changed to 105
Jun 15 05:40:30 reverse-host rsyslogd[34]: [origin software="rsyslogd" swVersion="8.2112.0" x-pid="34" x-info="https://www.rsyslog.com"] start

● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/lib/systemd/system/ssh.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-06-15 05:40:30 UTC; 7min ago
       Docs: man:sshd(8)
             man:sshd_config(5)
   Main PID: 40 (sshd)
      Tasks: 1 (limit: 23154)
     Memory: 1.7M
        CPU: 25ms
     CGroup: /system.slice/docker-444305b37e671af013d8f2e64cca4909dd3dd2d084ce41348974586e7fcfd227.scope/system.slice/ssh.service
             └─40 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"

Jun 15 05:40:30 reverse-host systemd[1]: Starting OpenBSD Secure Shell server...
Jun 15 05:40:30 reverse-host sshd[40]: Server listening on 0.0.0.0 port 22.
Jun 15 05:40:30 reverse-host sshd[40]: Server listening on :: port 22.
Jun 15 05:40:30 reverse-host systemd[1]: Started OpenBSD Secure Shell server.

● systemd-journald.service - Journal Service
     Loaded: loaded (/lib/systemd/system/systemd-journald.service; static)
     Active: active (running) since Mon 2026-06-15 05:40:30 UTC; 7min ago
TriggeredBy: ○ systemd-journald-audit.socket
             ● systemd-journald.socket
             ● systemd-journald-dev-log.socket
       Docs: man:systemd-journald.service(8)
             man:journald.conf(5)
   Main PID: 33 (systemd-journal)
     Status: "Processing requests..."
      Tasks: 1 (limit: 23154)
     Memory: 9.8M
        CPU: 960ms
     CGroup: /system.slice/docker-444305b37e671af013d8f2e64cca4909dd3dd2d084ce41348974586e7fcfd227.scope/system.slice/systemd-journald.service
             └─33 /lib/systemd/systemd-journald

Jun 15 05:41:04 reverse-host systemd-journald[33]: Forwarding to syslog missed 1 messages.
Jun 15 05:41:04 reverse-host systemd[1]: systemd-journald.service: Attaching egress BPF program to cgroup /sys/fs/cgroup/system.slice/docker-444305b37e671af013d8f2e64cca4909dd3dd2d084ce41348974586e7fcfd227.scope/system.slice/systemd-journald.service failed: Invalid argument
Jun 15 05:41:34 reverse-host systemd-journald[33]: Forwarding to syslog missed 27 messages.
Jun 15 05:42:46 reverse-host systemd[1]: systemd-journald.service: Attaching egress BPF program to cgroup /sys/fs/cgroup/system.slice/docker-444305b37e671af013d8f2e64cca4909dd3dd2d084ce41348974586e7fcfd227.scope/system.slice/systemd-journald.service failed: Invalid argument
Jun 15 05:42:54 reverse-host systemd[1]: systemd-journald.service: Attaching egress BPF program to cgroup /sys/fs/cgroup/system.slice/docker-444305b37e671af013d8f2e64cca4909dd3dd2d084ce41348974586e7fcfd227.scope/system.slice/systemd-journald.service failed: Invalid argument
Jun 15 05:42:54 reverse-host systemd[1]: systemd-journald.service: Attaching egress BPF program to cgroup /sys/fs/cgroup/system.slice/docker-444305b37e671af013d8f2e64cca4909dd3dd2d084ce41348974586e7fcfd227.scope/system.slice/systemd-journald.service failed: Invalid argument
Jun 15 05:42:55 reverse-host systemd[1]: systemd-journald.service: Attaching egress BPF program to cgroup /sys/fs/cgroup/system.slice/docker-444305b37e671af013d8f2e64cca4909dd3dd2d084ce41348974586e7fcfd227.scope/system.slice/systemd-journald.service failed: Invalid argument
Jun 15 05:43:48 reverse-host systemd-journald[33]: Forwarding to syslog missed 14 messages.
Jun 15 05:44:18 reverse-host systemd-journald[33]: Forwarding to syslog missed 8 messages.
Jun 15 05:44:48 reverse-host systemd-journald[33]: Forwarding to syslog missed 7 messages.

● systemd-user-sessions.service - Permit User Sessions
     Loaded: loaded (/lib/systemd/system/systemd-user-sessions.service; enabled; vendor preset: enabled)
     Active: active (exited) since Mon 2026-06-15 05:40:30 UTC; 7min ago
       Docs: man:systemd-user-sessions.service(8)
   Main PID: 36 (code=exited, status=0/SUCCESS)
        CPU: 4ms

Jun 15 05:40:30 reverse-host systemd[1]: Starting Permit User Sessions...
Jun 15 05:40:30 reverse-host systemd[1]: Finished Permit User Sessions.

● wazuh-agent.service - Wazuh agent
     Loaded: loaded (/lib/systemd/system/wazuh-agent.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-06-15 05:41:16 UTC; 6min ago
      Tasks: 43 (limit: 23154)
     Memory: 22.6M
        CPU: 14.147s
     CGroup: /system.slice/docker-444305b37e671af013d8f2e64cca4909dd3dd2d084ce41348974586e7fcfd227.scope/system.slice/wazuh-agent.service
             ├─4275 /var/ossec/bin/wazuh-execd
             ├─4287 /var/ossec/bin/wazuh-agentd
             ├─4309 /var/ossec/bin/wazuh-syscheckd
             ├─4323 /var/ossec/bin/wazuh-logcollector
             └─4503 /var/ossec/bin/wazuh-modulesd

Jun 15 05:41:10 reverse-host systemd[1]: Starting Wazuh agent...
Jun 15 05:41:10 reverse-host env[3482]: Starting Wazuh v4.12.0...
Jun 15 05:41:11 reverse-host env[3482]: Started wazuh-execd...
Jun 15 05:41:12 reverse-host env[3482]: Started wazuh-agentd...
Jun 15 05:41:12 reverse-host env[3535]: 2026/06/15 05:41:12 wazuh-syscheckd: WARNING: The check_unixaudit option is deprecated in favor of the SCA module.
Jun 15 05:41:13 reverse-host env[3482]: Started wazuh-syscheckd...
Jun 15 05:41:13 reverse-host env[3482]: Started wazuh-logcollector...
Jun 15 05:41:14 reverse-host env[3482]: Started wazuh-modulesd...
Jun 15 05:41:16 reverse-host env[3482]: Completed.
Jun 15 05:41:16 reverse-host systemd[1]: Started Wazuh agent.

● falco-modern-bpf.service - Falco: Container Native Runtime Security with modern ebpf
     Loaded: loaded (/lib/systemd/system/falco-modern-bpf.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-06-15 05:41:04 UTC; 7min ago
       Docs: https://falco.org/docs/
   Main PID: 3228 (falco)
      Tasks: 32 (limit: 23154)
     Memory: 121.1M
        CPU: 1min 13.500s
     CGroup: /system.slice/docker-444305b37e671af013d8f2e64cca4909dd3dd2d084ce41348974586e7fcfd227.scope/system.slice/falco-modern-bpf.service
             └─3228 /usr/bin/falco -o engine.kind=modern_ebpf

Jun 15 05:41:05 reverse-host falco[3228]: [libs]: libpman: failure while attaching TOCTOU mitigation program for 'creat' system call. Detection will continue to work, but TOCTOU mitigation may not properly work (errno: 2 | message: No such file or directory)
Jun 15 05:41:05 reverse-host falco[3228]: [libs]: libbpf: failed to determine tracepoint 'syscalls/sys_enter_open' perf event ID: No such file or directory
Jun 15 05:41:05 reverse-host falco[3228]: [libs]: libbpf: prog 'open_e': failed to create tracepoint 'syscalls/sys_enter_open' perf event: No such file or directory
Jun 15 05:41:05 reverse-host falco[3228]: [libs]: libpman: failure while attaching TOCTOU mitigation program for 'open' system call. Detection will continue to work, but TOCTOU mitigation may not properly work (errno: 2 | message: No such file or directory)
Jun 15 05:41:05 reverse-host falco[3228]: [libs]: libbpf: failed to determine tracepoint 'syscalls/sys_enter_openat2' perf event ID: No such file or directory
Jun 15 05:41:05 reverse-host falco[3228]: [libs]: libbpf: prog 'openat2_e': failed to create tracepoint 'syscalls/sys_enter_openat2' perf event: No such file or directory
Jun 15 05:41:05 reverse-host falco[3228]: [libs]: libpman: failure while attaching TOCTOU mitigation program for 'openat2' system call. Detection will continue to work, but TOCTOU mitigation may not properly work (errno: 2 | message: No such file or director
Jun 15 05:41:05 reverse-host falco[3228]: [libs]: libbpf: failed to determine tracepoint 'syscalls/sys_enter_openat' perf event ID: No such file or directory
Jun 15 05:41:05 reverse-host falco[3228]: [libs]: libbpf: prog 'openat_e': failed to create tracepoint 'syscalls/sys_enter_openat' perf event: No such file or directory
Jun 15 05:41:05 reverse-host falco[3228]: [libs]: libpman: failure while attaching TOCTOU mitigation program for 'openat' system call. Detection will continue to work, but TOCTOU mitigation may not properly work (errno: 2 | message: No such file or directory

● falcoctl-artifact-follow.service - Falcoctl Artifact Follow: automatic artifacts update service
     Loaded: loaded (/lib/systemd/system/falcoctl-artifact-follow.service; disabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-06-15 05:41:04 UTC; 7min ago
       Docs: https://falco.org/docs/
   Main PID: 3229 (falcoctl)
      Tasks: 13 (limit: 23154)
     Memory: 16.4M
        CPU: 118ms
     CGroup: /system.slice/docker-444305b37e671af013d8f2e64cca4909dd3dd2d084ce41348974586e7fcfd227.scope/system.slice/falcoctl-artifact-follow.service
             └─3229 /usr/bin/falcoctl artifact follow --allowed-types=rulesfile

Jun 15 05:41:04 reverse-host systemd[1]: Started Falcoctl Artifact Follow: automatic artifacts update service.
Jun 15 05:41:04 reverse-host falcoctl[3229]: 2026-06-15 05:41:04 INFO  Creating follower
Jun 15 05:41:04 reverse-host falcoctl[3229]:                       ├ artifact: falco-rules:5
Jun 15 05:41:04 reverse-host falcoctl[3229]:                       └ check every: 168h0m0s
Jun 15 05:41:04 reverse-host falcoctl[3229]: 2026-06-15 05:41:04 INFO  Starting follower
Jun 15 05:41:04 reverse-host falcoctl[3229]:                       └ artifact: ghcr.io/falcosecurity/rules/falco-rules:5
