[ossec-list] Rootkit detection

[peter@xxxxxxx]

Hi everybody,

I'm receiving lots of messages from the rootkit engine:

-------------------
Received From: (em) 1.2.3.4->rootcheck
Rule: 14 fired (level 8) -> "Rootkit detection engine message'"
Portion of the log(s):

Port '49277'(tcp) hidden. Kernel-level rootkit or trojaned version of
netstat.
-------------------

The warning is correct because the machine is running serveral vservers
(http://linux-vserver.org/), so there are hidden ports and/or processes.

Is there anything I can do besides switching rootkit detection off?

Thanks Peter



--~--~---------~--~----~------------~-------~--~----~
-~----------~----~----~----~------~----~------~--~---