Posture Check Linux Service

[qrkourier]

Capabilities might include:

• Is the service unit defined (loaded)?
• Does the unit have a running MainPID?
• Is the MainPID's EUID expected?
• Does the MainPID have the expected kernel capabilities?
• Is the MainPID running in the expected kernel namespace?
• Does the base unit definition match a checksum?
• Does the unit have any drop-in overrides?
• Is the unit enabled for startup after a reboot?
• Is the unit active (running)?
• Does the unit have ExecMainStatus=0 (not failed)?
• Is the current invocation ID's journal anomalous (exceeds byte threshold, [doesn't] contain string, unusual incidence of ERROR messages)
• Are CPU, memory, and I/O accounting enabled for the unit?
• Are resource usages anamolous (CPUUsageNSec, MemoryCurrent, IOReadBytes, IOWriteBytes)?