1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
|
{
"timestamp": "2024-08-31T08:14:08.325Z",
"fileName": "/proc/self/oom_score_adj",
"pid": 29662,
"fd": 7,
"flags": [
140727329818688,
2,
140727329818712,
140727329815648
],
"written": [
"2024-08-31T08:14:08.325Z"
],
"close_timestamp": "2024-08-31T08:14:08.325Z",
"FileNamePointer": "0x7ffda2810840",
"FileFlags": "O_RDONLY | O_RDWR"
}
{
"timestamp": "2024-08-31T08:14:10.789Z",
"fileName": "/proc/self/oom_score_adj",
"pid": 29705,
"fd": 6,
"flags": [
140737394046768,
2,
140737394046792,
140737394043680
],
"written": [
"2024-08-31T08:14:10.789Z"
],
"close_timestamp": "2024-08-31T08:14:10.789Z",
"FileNamePointer": "0x7ffffa60f730",
"FileFlags": "O_RDONLY | O_RDWR"
}
{
"timestamp": "2024-08-31T08:14:23.917Z",
"fileName": "/root/.bash_history",
"pid": 29709,
"fd": 3,
"flags": [
10822472,
1025,
384,
8
],
"written": [
"2024-08-31T08:14:23.917Z"
],
"close_timestamp": "2024-08-31T08:14:23.917Z",
"FileNamePointer": "0x000000a52348",
"FileFlags": "O_APPEND | O_RDONLY | O_WRONLY"
}
{
"timestamp": "2024-08-31T08:14:15.361Z",
"fileName": "/root/.hello.c.swp",
"pid": 29723,
"fd": 4,
"flags": [
93986886181648,
131266,
384,
140283278240632
],
"written": [
"2024-08-31T08:14:15.361Z",
"2024-08-31T08:14:17.782Z",
"2024-08-31T08:14:21.953Z"
],
"close_timestamp": "2024-08-31T08:14:21.953Z",
"FileNamePointer": "0x557b06f6e310",
"FileFlags": "O_CREAT | O_EXCL | O_NOFOLLOW | O_RDONLY | O_RDWR"
}
{
"timestamp": "2024-08-31T08:14:15.361Z",
"fileName": "/root/.hello.c.swp",
"pid": 29723,
"fd": 4,
"flags": [
93986886181648,
194,
384,
17
],
"written": [],
"close_timestamp": "2024-08-31T08:14:15.361Z",
"FileNamePointer": "0x557b06f6e310",
"FileFlags": "O_CREAT | O_EXCL | O_RDONLY | O_RDWR"
}
{
"timestamp": "2024-08-31T08:14:15.361Z",
"fileName": "/root/.hello.c.swx",
"pid": 29723,
"fd": 5,
"flags": [
93986884210448,
194,
384,
17
],
"written": [],
"close_timestamp": "2024-08-31T08:14:15.361Z",
"FileNamePointer": "0x557b06d8cf10",
"FileFlags": "O_CREAT | O_EXCL | O_RDONLY | O_RDWR"
}
{
"timestamp": "2024-08-31T08:14:21.953Z",
"fileName": "/root/.viminfo.tmp",
"pid": 29723,
"fd": 5,
"flags": [
93986886181872,
131265,
384,
0
],
"written": [
"2024-08-31T08:14:21.953Z"
],
"close_timestamp": "2024-08-31T08:14:21.953Z",
"FileNamePointer": "0x557b06f6e3f0",
"FileFlags": "O_CREAT | O_EXCL | O_NOFOLLOW | O_RDONLY | O_WRONLY"
}
{
"timestamp": "2024-08-31T08:14:21.95Z",
"fileName": "/root/4913",
"pid": 29723,
"fd": 3,
"flags": [
93986884186640,
131265,
33188,
0
],
"written": [],
"close_timestamp": "2024-08-31T08:14:21.95Z",
"FileNamePointer": "0x557b06d87210",
"FileFlags": "O_CREAT | O_EXCL | O_NOFOLLOW | O_RDONLY | O_WRONLY"
}
{
"timestamp": "2024-08-31T08:14:21.95Z",
"fileName": "/root/hello.c",
"pid": 29723,
"fd": 3,
"flags": [
93986884214912,
577,
420,
0
],
"written": [
"2024-08-31T08:14:21.95Z",
"2024-08-31T08:14:21.95Z"
],
"close_timestamp": "2024-08-31T08:14:21.953Z",
"FileNamePointer": "0x557b06d8e080",
"FileFlags": "O_CREAT | O_RDONLY | O_TRUNC | O_WRONLY"
}
{
"timestamp": "2024-08-31T08:14:08.283Z",
"fileName": "/var/run/docker/runtime-runc/moby/15dbc96260a73fe3b7cae2ccefb70f6982f291429a9664fb95f44a6833468f19/runc.Avdn7E",
"pid": 29662,
"fd": 7,
"flags": [
140730884269360,
194,
384,
1725092048
],
"written": [],
"close_timestamp": "2024-08-31T08:14:08.283Z",
"FileNamePointer": "0x7ffe765da530",
"FileFlags": "O_CREAT | O_EXCL | O_RDONLY | O_RDWR"
}
{
"timestamp": "2024-08-31T08:14:10.776Z",
"fileName": "/var/run/docker/runtime-runc/moby/15dbc96260a73fe3b7cae2ccefb70f6982f291429a9664fb95f44a6833468f19/runc.jV9mvl",
"pid": 29705,
"fd": 6,
"flags": [
140727845211728,
194,
384,
1725092050
],
"written": [],
"close_timestamp": "2024-08-31T08:14:10.776Z",
"FileNamePointer": "0x7ffdc1394e50",
"FileFlags": "O_CREAT | O_EXCL | O_RDONLY | O_RDWR"
}
|
