Skip to content

Instantly share code, notes, and snippets.

@natebeaty

natebeaty/wtf-is-happening.txt Secret

Created August 21, 2017 14:30
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save natebeaty/ed55bc9825b4cba221878ee4e415fecc to your computer and use it in GitHub Desktop.
Save natebeaty/ed55bc9825b4cba221878ee4e415fecc to your computer and use it in GitHub Desktop.
Download ZIP
output of `sudo ausearch -k git_was_run` tracking `git status -s` running repeatedly
Raw
wtf-is-happening.txt
----
time->Mon Aug 21 07:28:06 2017
type=PROCTITLE msg=audit(1503325686.047:349): proctitle=6769740072656D6F7465
type=PATH msg=audit(1503325686.047:349): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325686.047:349): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325686.047:349): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325686.047:349): argc=2 a0="git" a1="remote"
type=SYSCALL msg=audit(1503325686.047:349): arch=c000003e syscall=59 success=yes exit=0 a0=559f8b1c88a8 a1=559f8963ad18 a2=559f8b1c87e8 a3=7fdecf9559d0 items=2 ppid=30434 pid=30435 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:06 2017
type=PROCTITLE msg=audit(1503325686.050:350): proctitle=6769740073686F772D72656600726566732F72656D6F7465732F6F726967696E2F6D6173746572
type=PATH msg=audit(1503325686.050:350): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325686.050:350): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325686.050:350): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325686.050:350): argc=3 a0="git" a1="show-ref" a2="refs/remotes/origin/master"
type=SYSCALL msg=audit(1503325686.050:350): arch=c000003e syscall=59 success=yes exit=0 a0=5638835c6628 a1=5638835c6520 a2=5638835c6568 a3=7fcdd13f99d0 items=2 ppid=30436 pid=30437 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:06 2017
type=PROCTITLE msg=audit(1503325686.057:351): proctitle=676974006C6F67006F726967696E2F6D6173746572002D2D7072657474793D6F6E656C696E65002D6E00313030
type=PATH msg=audit(1503325686.057:351): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325686.057:351): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325686.057:351): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325686.057:351): argc=6 a0="git" a1="log" a2="origin/master" a3="--pretty=oneline" a4="-n" a5="100"
type=SYSCALL msg=audit(1503325686.057:351): arch=c000003e syscall=59 success=yes exit=0 a0=55e8e7fe3948 a1=55e8e7fe35b0 a2=55e8e7fe3610 a3=7f322ba329d0 items=2 ppid=30438 pid=30439 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:04 2017
type=PROCTITLE msg=audit(1503325684.064:339): proctitle=676974007265762D7061727365002D2D6162627265762D7265660048454144
type=PATH msg=audit(1503325684.064:339): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325684.064:339): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325684.064:339): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325684.064:339): argc=4 a0="git" a1="rev-parse" a2="--abbrev-ref" a3="HEAD"
type=SYSCALL msg=audit(1503325684.064:339): arch=c000003e syscall=59 success=yes exit=0 a0=555602472658 a1=555602472548 a2=555602472598 a3=7fe1b6fb39d0 items=2 ppid=30413 pid=30414 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:04 2017
type=PROCTITLE msg=audit(1503325684.067:340): proctitle=6769740072656D6F7465
type=PATH msg=audit(1503325684.067:340): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325684.067:340): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325684.067:340): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325684.067:340): argc=2 a0="git" a1="remote"
type=SYSCALL msg=audit(1503325684.067:340): arch=c000003e syscall=59 success=yes exit=0 a0=559acd2568a8 a1=559acc2d8d18 a2=559acd2567e8 a3=7f30e5a7b9d0 items=2 ppid=30415 pid=30416 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:04 2017
type=PROCTITLE msg=audit(1503325684.070:341): proctitle=6769740073686F772D72656600726566732F72656D6F7465732F6F726967696E2F6D6173746572
type=PATH msg=audit(1503325684.070:341): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325684.070:341): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325684.070:341): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325684.070:341): argc=3 a0="git" a1="show-ref" a2="refs/remotes/origin/master"
type=SYSCALL msg=audit(1503325684.070:341): arch=c000003e syscall=59 success=yes exit=0 a0=55cbe1a5e628 a1=55cbe1a5e520 a2=55cbe1a5e568 a3=7f293749f9d0 items=2 ppid=30417 pid=30418 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:04 2017
type=PROCTITLE msg=audit(1503325684.074:342): proctitle=676974006C6F67006F726967696E2F6D6173746572002D2D7072657474793D6F6E656C696E65002D6E00313030
type=PATH msg=audit(1503325684.074:342): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325684.074:342): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325684.074:342): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325684.074:342): argc=6 a0="git" a1="log" a2="origin/master" a3="--pretty=oneline" a4="-n" a5="100"
type=SYSCALL msg=audit(1503325684.074:342): arch=c000003e syscall=59 success=yes exit=0 a0=55682ced1948 a1=55682ced15b0 a2=55682ced1610 a3=7f202c7139d0 items=2 ppid=30419 pid=30420 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:04 2017
type=PROCTITLE msg=audit(1503325684.087:343): proctitle=67697400746167
type=PATH msg=audit(1503325684.087:343): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325684.087:343): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325684.087:343): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325684.087:343): argc=2 a0="git" a1="tag"
type=SYSCALL msg=audit(1503325684.087:343): arch=c000003e syscall=59 success=yes exit=0 a0=559aa73278a8 a1=559aa5e59d18 a2=559aa73277e8 a3=7fd26ca1e9d0 items=2 ppid=30421 pid=30422 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:04 2017
type=PROCTITLE msg=audit(1503325684.090:344): proctitle=67697400636F6E666967002D2D6765740072656D6F74652E6F726967696E2E75726C
type=PATH msg=audit(1503325684.090:344): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325684.090:344): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325684.090:344): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325684.090:344): argc=4 a0="git" a1="config" a2="--get" a3="remote.origin.url"
type=SYSCALL msg=audit(1503325684.090:344): arch=c000003e syscall=59 success=yes exit=0 a0=562c1fdcb658 a1=562c1fdcb548 a2=562c1fdcb598 a3=7f3d315f99d0 items=2 ppid=30423 pid=30424 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:04 2017
type=PROCTITLE msg=audit(1503325684.094:345): proctitle=6769740073686F77002D2D7175696574002D2D666F726D61743D2548256E256144256E2573256E25420048454144
type=PATH msg=audit(1503325684.094:345): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325684.094:345): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325684.094:345): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325684.094:345): argc=5 a0="git" a1="show" a2="--quiet" a3="--format=%H%n%aD%n%s%n%B" a4="HEAD"
type=SYSCALL msg=audit(1503325684.094:345): arch=c000003e syscall=59 success=yes exit=0 a0=560541b416b0 a1=560541b41598 a2=560541b415f0 a3=7f687f73e9d0 items=2 ppid=30425 pid=30426 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:04 2017
type=PROCTITLE msg=audit(1503325684.097:346): proctitle=67697400737461747573002D73
type=PATH msg=audit(1503325684.097:346): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325684.097:346): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325684.097:346): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325684.097:346): argc=3 a0="git" a1="status" a2="-s"
type=SYSCALL msg=audit(1503325684.097:346): arch=c000003e syscall=59 success=yes exit=0 a0=55c35bfb8620 a1=55c35a821d58 a2=55c35bfb8560 a3=7f02efcdb9d0 items=2 ppid=30427 pid=30428 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:06 2017
type=PROCTITLE msg=audit(1503325686.030:348): proctitle=676974007265762D7061727365002D2D6162627265762D7265660048454144
type=PATH msg=audit(1503325686.030:348): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325686.030:348): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325686.030:348): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325686.030:348): argc=4 a0="git" a1="rev-parse" a2="--abbrev-ref" a3="HEAD"
type=SYSCALL msg=audit(1503325686.030:348): arch=c000003e syscall=59 success=yes exit=0 a0=557efc726658 a1=557efc726548 a2=557efc726598 a3=7fd9e02e89d0 items=2 ppid=30432 pid=30433 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:06 2017
type=PROCTITLE msg=audit(1503325686.060:352): proctitle=67697400746167
type=PATH msg=audit(1503325686.060:352): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325686.060:352): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325686.060:352): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325686.060:352): argc=2 a0="git" a1="tag"
type=SYSCALL msg=audit(1503325686.060:352): arch=c000003e syscall=59 success=yes exit=0 a0=55b3f44948a8 a1=55b3f41fed18 a2=55b3f44947e8 a3=7f9191cf39d0 items=2 ppid=30440 pid=30441 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:32 2017
type=PROCTITLE msg=audit(1503325712.130:358): proctitle=6769740073686F77002D2D7175696574002D2D666F726D61743D2548256E256144256E2573256E25420048454144
type=PATH msg=audit(1503325712.130:358): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325712.130:358): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325712.130:358): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325712.130:358): argc=5 a0="git" a1="show" a2="--quiet" a3="--format=%H%n%aD%n%s%n%B" a4="HEAD"
type=SYSCALL msg=audit(1503325712.130:358): arch=c000003e syscall=59 success=yes exit=0 a0=557b921456b0 a1=557b92145598 a2=557b921455f0 a3=7f61d3a559d0 items=2 ppid=30467 pid=30468 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:32 2017
type=PROCTITLE msg=audit(1503325712.126:357): proctitle=67697400636F6E666967002D2D6765740072656D6F74652E6F726967696E2E75726C
type=PATH msg=audit(1503325712.126:357): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325712.126:357): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325712.126:357): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325712.126:357): argc=4 a0="git" a1="config" a2="--get" a3="remote.origin.url"
type=SYSCALL msg=audit(1503325712.126:357): arch=c000003e syscall=59 success=yes exit=0 a0=55f59fafb658 a1=55f59fafb548 a2=55f59fafb598 a3=7ff82fdc69d0 items=2 ppid=30465 pid=30466 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:32 2017
type=PROCTITLE msg=audit(1503325712.136:359): proctitle=67697400737461747573002D73
type=PATH msg=audit(1503325712.136:359): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325712.136:359): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325712.136:359): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325712.136:359): argc=3 a0="git" a1="status" a2="-s"
type=SYSCALL msg=audit(1503325712.136:359): arch=c000003e syscall=59 success=yes exit=0 a0=561a90e0e620 a1=561a8f4bad58 a2=561a90e0e560 a3=7f2183df79d0 items=2 ppid=30469 pid=30470 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:36 2017
type=PROCTITLE msg=audit(1503325716.146:369): proctitle=6769740072656D6F7465
type=PATH msg=audit(1503325716.146:369): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325716.146:369): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325716.146:369): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325716.146:369): argc=2 a0="git" a1="remote"
type=SYSCALL msg=audit(1503325716.146:369): arch=c000003e syscall=59 success=yes exit=0 a0=55abb7e568a8 a1=55abb6ffdd18 a2=55abb7e567e8 a3=7f27445a59d0 items=2 ppid=30494 pid=30495 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:36 2017
type=PROCTITLE msg=audit(1503325716.149:370): proctitle=6769740073686F772D72656600726566732F72656D6F7465732F6F726967696E2F6D6173746572
type=PATH msg=audit(1503325716.149:370): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325716.149:370): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325716.149:370): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325716.149:370): argc=3 a0="git" a1="show-ref" a2="refs/remotes/origin/master"
type=SYSCALL msg=audit(1503325716.149:370): arch=c000003e syscall=59 success=yes exit=0 a0=564d1a265628 a1=564d1a265520 a2=564d1a265568 a3=7f57ae4b09d0 items=2 ppid=30496 pid=30497 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:36 2017
type=PROCTITLE msg=audit(1503325716.156:371): proctitle=676974006C6F67006F726967696E2F6D6173746572002D2D7072657474793D6F6E656C696E65002D6E00313030
type=PATH msg=audit(1503325716.156:371): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325716.156:371): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325716.156:371): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325716.156:371): argc=6 a0="git" a1="log" a2="origin/master" a3="--pretty=oneline" a4="-n" a5="100"
type=SYSCALL msg=audit(1503325716.156:371): arch=c000003e syscall=59 success=yes exit=0 a0=56232dcda948 a1=56232dcda5b0 a2=56232dcda610 a3=7f90a1b249d0 items=2 ppid=30498 pid=30499 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:34 2017
type=PROCTITLE msg=audit(1503325714.100:360): proctitle=676974007265762D7061727365002D2D6162627265762D7265660048454144
type=PATH msg=audit(1503325714.100:360): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325714.100:360): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325714.100:360): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325714.100:360): argc=4 a0="git" a1="rev-parse" a2="--abbrev-ref" a3="HEAD"
type=SYSCALL msg=audit(1503325714.100:360): arch=c000003e syscall=59 success=yes exit=0 a0=5622387d3658 a1=5622387d3548 a2=5622387d3598 a3=7fc3da41f9d0 items=2 ppid=30474 pid=30475 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:34 2017
type=PROCTITLE msg=audit(1503325714.103:361): proctitle=6769740072656D6F7465
type=PATH msg=audit(1503325714.103:361): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325714.103:361): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325714.103:361): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325714.103:361): argc=2 a0="git" a1="remote"
type=SYSCALL msg=audit(1503325714.103:361): arch=c000003e syscall=59 success=yes exit=0 a0=55d5bc77b8a8 a1=55d5bb367d18 a2=55d5bc77b7e8 a3=7f5aa39239d0 items=2 ppid=30476 pid=30477 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:34 2017
type=PROCTITLE msg=audit(1503325714.106:362): proctitle=6769740073686F772D72656600726566732F72656D6F7465732F6F726967696E2F6D6173746572
type=PATH msg=audit(1503325714.106:362): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325714.106:362): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325714.106:362): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325714.106:362): argc=3 a0="git" a1="show-ref" a2="refs/remotes/origin/master"
type=SYSCALL msg=audit(1503325714.106:362): arch=c000003e syscall=59 success=yes exit=0 a0=55a01e84f628 a1=55a01e84f520 a2=55a01e84f568 a3=7f14376f69d0 items=2 ppid=30478 pid=30479 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:34 2017
type=PROCTITLE msg=audit(1503325714.126:363): proctitle=676974006C6F67006F726967696E2F6D6173746572002D2D7072657474793D6F6E656C696E65002D6E00313030
type=PATH msg=audit(1503325714.126:363): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325714.126:363): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325714.126:363): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325714.126:363): argc=6 a0="git" a1="log" a2="origin/master" a3="--pretty=oneline" a4="-n" a5="100"
type=SYSCALL msg=audit(1503325714.126:363): arch=c000003e syscall=59 success=yes exit=0 a0=564989e24948 a1=564989e245b0 a2=564989e24610 a3=7f23bea499d0 items=2 ppid=30480 pid=30481 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:34 2017
type=PROCTITLE msg=audit(1503325714.133:364): proctitle=67697400746167
type=PATH msg=audit(1503325714.133:364): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325714.133:364): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325714.133:364): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325714.133:364): argc=2 a0="git" a1="tag"
type=SYSCALL msg=audit(1503325714.133:364): arch=c000003e syscall=59 success=yes exit=0 a0=562bb604d8a8 a1=562bb59ded18 a2=562bb604d7e8 a3=7f013ea039d0 items=2 ppid=30482 pid=30483 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:34 2017
type=PROCTITLE msg=audit(1503325714.140:365): proctitle=67697400636F6E666967002D2D6765740072656D6F74652E6F726967696E2E75726C
type=PATH msg=audit(1503325714.140:365): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325714.140:365): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325714.140:365): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325714.140:365): argc=4 a0="git" a1="config" a2="--get" a3="remote.origin.url"
type=SYSCALL msg=audit(1503325714.140:365): arch=c000003e syscall=59 success=yes exit=0 a0=564af9e00658 a1=564af9e00548 a2=564af9e00598 a3=7fe5aef039d0 items=2 ppid=30484 pid=30485 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:34 2017
type=PROCTITLE msg=audit(1503325714.143:366): proctitle=6769740073686F77002D2D7175696574002D2D666F726D61743D2548256E256144256E2573256E25420048454144
type=PATH msg=audit(1503325714.143:366): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325714.143:366): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325714.143:366): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325714.143:366): argc=5 a0="git" a1="show" a2="--quiet" a3="--format=%H%n%aD%n%s%n%B" a4="HEAD"
type=SYSCALL msg=audit(1503325714.143:366): arch=c000003e syscall=59 success=yes exit=0 a0=56320782e6b0 a1=56320782e598 a2=56320782e5f0 a3=7f4b391369d0 items=2 ppid=30486 pid=30487 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:34 2017
type=PROCTITLE msg=audit(1503325714.146:367): proctitle=67697400737461747573002D73
type=PATH msg=audit(1503325714.146:367): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325714.146:367): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325714.146:367): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325714.146:367): argc=3 a0="git" a1="status" a2="-s"
type=SYSCALL msg=audit(1503325714.146:367): arch=c000003e syscall=59 success=yes exit=0 a0=56516d975620 a1=56516d2bed58 a2=56516d975560 a3=7f24d36b09d0 items=2 ppid=30488 pid=30489 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:36 2017
type=PROCTITLE msg=audit(1503325716.139:368): proctitle=676974007265762D7061727365002D2D6162627265762D7265660048454144
type=PATH msg=audit(1503325716.139:368): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325716.139:368): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325716.139:368): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325716.139:368): argc=4 a0="git" a1="rev-parse" a2="--abbrev-ref" a3="HEAD"
type=SYSCALL msg=audit(1503325716.139:368): arch=c000003e syscall=59 success=yes exit=0 a0=564f88976658 a1=564f88976548 a2=564f88976598 a3=7f172d7a99d0 items=2 ppid=30492 pid=30493 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
----
time->Mon Aug 21 07:28:36 2017
type=PROCTITLE msg=audit(1503325716.169:372): proctitle=67697400746167
type=PATH msg=audit(1503325716.169:372): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=49398 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=PATH msg=audit(1503325716.169:372): item=0 name="/usr/bin/git" inode=12467 dev=08:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1503325716.169:372): cwd="/var/www/sitename.com/public_html"
type=EXECVE msg=audit(1503325716.169:372): argc=2 a0="git" a1="tag"
type=SYSCALL msg=audit(1503325716.169:372): arch=c000003e syscall=59 success=yes exit=0 a0=55a5bcb3a8a8 a1=55a5bc835d18 a2=55a5bcb3a7e8 a3=7f07767a29d0 items=2 ppid=30500 pid=30501 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=9 comm="git" exe="/usr/bin/git" key="git_was_run"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment