search

microsoft / omi

Open Management Infrastructure
Other
367 stars 116 forks source link

Omi and nxautomation users being created deleted and recreated weekly #766

Closed jcwimer closed 4 months ago

jcwimer commented 4 months ago

Hello,

I have multiple VMs which are throwing alerts from my SEIM provider because the omi and nxautomation users are being deleted and recreated over and over.

Is there a reason for this?

On May 20:

May 20 11:34:50 REDACTED_VM_NAME userdel[28013]: delete user 'nxautomation'
May 20 11:34:50 REDACTED_VM_NAME userdel[28013]: delete 'nxautomation' from group 'omiusers'
May 20 11:34:50 REDACTED_VM_NAME userdel[28013]: delete 'nxautomation' from group 'omsagent'
May 20 11:34:50 REDACTED_VM_NAME userdel[28013]: removed group 'nxautomation' owned by 'nxautomation'
May 20 11:34:50 REDACTED_VM_NAME userdel[28013]: removed shadow group 'nxautomation' owned by 'nxautomation'
May 20 11:34:50 REDACTED_VM_NAME userdel[28013]: delete 'nxautomation' from shadow group 'omiusers'
May 20 11:34:50 REDACTED_VM_NAME userdel[28013]: delete 'nxautomation' from shadow group 'omsagent'
May 20 11:34:50 REDACTED_VM_NAME userdel[28021]: delete user 'omsagent'
May 20 11:34:50 REDACTED_VM_NAME groupdel[28030]: group 'omsagent' removed from /etc/group
May 20 11:34:50 REDACTED_VM_NAME groupdel[28030]: group 'omsagent' removed from /etc/gshadow
May 20 11:34:50 REDACTED_VM_NAME groupdel[28030]: group 'omsagent' removed
May 20 11:34:51 REDACTED_VM_NAME groupdel[28290]: group 'omiusers' removed from /etc/group
May 20 11:34:51 REDACTED_VM_NAME groupdel[28290]: group 'omiusers' removed from /etc/gshadow
May 20 11:34:51 REDACTED_VM_NAME groupdel[28290]: group 'omiusers' removed
May 20 11:34:51 REDACTED_VM_NAME userdel[28298]: delete user 'omi'
May 20 11:34:51 REDACTED_VM_NAME userdel[28298]: removed group 'omi' owned by 'omi'
May 20 11:34:51 REDACTED_VM_NAME userdel[28298]: removed shadow group 'omi' owned by 'omi'
May 20 11:34:55 REDACTED_VM_NAME groupadd[28446]: group added to /etc/group: name=omiusers, GID=998
May 20 11:34:55 REDACTED_VM_NAME groupadd[28446]: group added to /etc/gshadow: name=omiusers
May 20 11:34:55 REDACTED_VM_NAME groupadd[28446]: new group: name=omiusers, GID=998
May 20 11:34:55 REDACTED_VM_NAME groupadd[28453]: group added to /etc/group: name=omi, GID=997
May 20 11:34:55 REDACTED_VM_NAME groupadd[28453]: group added to /etc/gshadow: name=omi
May 20 11:34:55 REDACTED_VM_NAME groupadd[28453]: new group: name=omi, GID=997
May 20 11:34:55 REDACTED_VM_NAME useradd[28460]: new user: name=omi, UID=997, GID=997, home=/home/omi, shell=/bin/false, from=none
May 20 11:34:57 REDACTED_VM_NAME groupadd[28957]: group added to /etc/group: name=omsagent, GID=996
May 20 11:34:57 REDACTED_VM_NAME groupadd[28957]: group added to /etc/gshadow: name=omsagent
May 20 11:34:57 REDACTED_VM_NAME groupadd[28957]: new group: name=omsagent, GID=996
May 20 11:34:57 REDACTED_VM_NAME useradd[28969]: new user: name=omsagent, UID=996, GID=996, home=/var/opt/microsoft/omsagent/run, shell=/bin/bash, from=none
May 20 11:34:57 REDACTED_VM_NAME usermod[28987]: change user 'omsagent' GID from '996' to '998'
May 20 11:34:57 REDACTED_VM_NAME usermod[28987]: add 'omsagent' to group 'omi'
May 20 11:34:57 REDACTED_VM_NAME usermod[28987]: add 'omsagent' to shadow group 'omi'
May 20 11:34:57 REDACTED_VM_NAME groupadd[29001]: group added to /etc/group: name=nxautomation, GID=995
May 20 11:34:57 REDACTED_VM_NAME groupadd[29001]: group added to /etc/gshadow: name=nxautomation
May 20 11:34:57 REDACTED_VM_NAME groupadd[29001]: new group: name=nxautomation, GID=995
May 20 11:34:57 REDACTED_VM_NAME useradd[29008]: new user: name=nxautomation, UID=995, GID=995, home=/home/nxautomation/run, shell=/bin/bash, from=none
May 20 11:34:57 REDACTED_VM_NAME usermod[29018]: add 'nxautomation' to group 'omiusers'
May 20 11:34:57 REDACTED_VM_NAME usermod[29018]: add 'nxautomation' to group 'omsagent'
May 20 11:34:57 REDACTED_VM_NAME usermod[29018]: add 'nxautomation' to shadow group 'omiusers'
May 20 11:34:57 REDACTED_VM_NAME usermod[29018]: add 'nxautomation' to shadow group 'omsagent'

On May 27:

May 27 23:04:43 REDACTED_VM_NAME userdel[109436]: delete user 'nxautomation'
May 27 23:04:43 REDACTED_VM_NAME userdel[109436]: delete 'nxautomation' from group 'omiusers'
May 27 23:04:43 REDACTED_VM_NAME userdel[109436]: delete 'nxautomation' from group 'omsagent'
May 27 23:04:43 REDACTED_VM_NAME userdel[109436]: removed group 'nxautomation' owned by 'nxautomation'
May 27 23:04:43 REDACTED_VM_NAME userdel[109436]: removed shadow group 'nxautomation' owned by 'nxautomation'
May 27 23:04:43 REDACTED_VM_NAME userdel[109436]: delete 'nxautomation' from shadow group 'omiusers'
May 27 23:04:43 REDACTED_VM_NAME userdel[109436]: delete 'nxautomation' from shadow group 'omsagent'
May 27 23:04:43 REDACTED_VM_NAME userdel[109443]: delete user 'omsagent'
May 27 23:04:43 REDACTED_VM_NAME groupdel[109452]: group 'omsagent' removed from /etc/group
May 27 23:04:43 REDACTED_VM_NAME groupdel[109452]: group 'omsagent' removed from /etc/gshadow
May 27 23:04:43 REDACTED_VM_NAME groupdel[109452]: group 'omsagent' removed
May 27 23:04:44 REDACTED_VM_NAME groupdel[109693]: group 'omiusers' removed from /etc/group
May 27 23:04:44 REDACTED_VM_NAME groupdel[109693]: group 'omiusers' removed from /etc/gshadow
May 27 23:04:44 REDACTED_VM_NAME groupdel[109693]: group 'omiusers' removed
May 27 23:04:44 REDACTED_VM_NAME userdel[109700]: delete user 'omi'
May 27 23:04:44 REDACTED_VM_NAME userdel[109700]: removed group 'omi' owned by 'omi'
May 27 23:04:44 REDACTED_VM_NAME userdel[109700]: removed shadow group 'omi' owned by 'omi'
May 27 23:04:49 REDACTED_VM_NAME groupadd[109853]: group added to /etc/group: name=omiusers, GID=998
May 27 23:04:49 REDACTED_VM_NAME groupadd[109853]: group added to /etc/gshadow: name=omiusers
May 27 23:04:49 REDACTED_VM_NAME groupadd[109853]: new group: name=omiusers, GID=998
May 27 23:04:49 REDACTED_VM_NAME groupadd[109860]: group added to /etc/group: name=omi, GID=997
May 27 23:04:49 REDACTED_VM_NAME groupadd[109860]: group added to /etc/gshadow: name=omi
May 27 23:04:49 REDACTED_VM_NAME groupadd[109860]: new group: name=omi, GID=997
May 27 23:04:49 REDACTED_VM_NAME useradd[109867]: new user: name=omi, UID=997, GID=997, home=/home/omi, shell=/bin/false, from=none
May 27 23:04:50 REDACTED_VM_NAME groupadd[110319]: group added to /etc/group: name=omsagent, GID=996
May 27 23:04:50 REDACTED_VM_NAME groupadd[110319]: group added to /etc/gshadow: name=omsagent
May 27 23:04:50 REDACTED_VM_NAME groupadd[110319]: new group: name=omsagent, GID=996
May 27 23:04:50 REDACTED_VM_NAME useradd[110326]: new user: name=omsagent, UID=996, GID=996, home=/var/opt/microsoft/omsagent/run, shell=/bin/bash, from=none
May 27 23:04:50 REDACTED_VM_NAME usermod[110334]: change user 'omsagent' GID from '996' to '998'
May 27 23:04:50 REDACTED_VM_NAME usermod[110334]: add 'omsagent' to group 'omi'
May 27 23:04:50 REDACTED_VM_NAME usermod[110334]: add 'omsagent' to shadow group 'omi'
May 27 23:04:51 REDACTED_VM_NAME groupadd[110342]: group added to /etc/group: name=nxautomation, GID=995
May 27 23:04:51 REDACTED_VM_NAME groupadd[110342]: group added to /etc/gshadow: name=nxautomation
May 27 23:04:51 REDACTED_VM_NAME groupadd[110342]: new group: name=nxautomation, GID=995
May 27 23:04:51 REDACTED_VM_NAME useradd[110349]: new user: name=nxautomation, UID=995, GID=995, home=/home/nxautomation/run, shell=/bin/bash, from=none
May 27 23:04:51 REDACTED_VM_NAME usermod[110359]: add 'nxautomation' to group 'omiusers'
May 27 23:04:51 REDACTED_VM_NAME usermod[110359]: add 'nxautomation' to group 'omsagent'
May 27 23:04:51 REDACTED_VM_NAME usermod[110359]: add 'nxautomation' to shadow group 'omiusers'
May 27 23:04:51 REDACTED_VM_NAME usermod[110359]: add 'nxautomation' to shadow group 'omsagent'

image

jcwimer commented 4 months ago

Sorry closing to put in the agent repo: https://github.com/microsoft/OMS-Agent-for-Linux/issues/1566