Jan 8 00:04:08 bastion LinuxCommandsWazuh: User ankur [1699779]: 492 kubectl exec -it vortex-754684587f-ld8vj -- /bin/bash Jan 8 00:11:26 bastion LinuxCommandsWazuh: User devesh [1737301]: 488 byobu Jan 8 00:11:36 bastion LinuxCommandsWazuh: User devesh [290237]: 378 kubectl get pods | grep vortex Jan 8 00:18:52 bastion LinuxCommandsWazuh: User devesh [290237]: 379 kubectl logs -f vortex-754684587f-ld8vj Jan 8 00:21:23 bastion LinuxCommandsWazuh: User devesh [290237]: 380 kubectl logs -f vortex-754684587f-ld8vj Jan 8 00:35:07 bastion LinuxCommandsWazuh: User devesh [1214493]: 488 kubectl get pods Jan 8 00:35:15 bastion LinuxCommandsWazuh: User devesh [1214493]: 489 kubectl exec -it vortex-754684587f-ld8vj Jan 8 00:38:52 bastion LinuxCommandsWazuh: User ankur [1699779]: 493 kubectl logs -f service/vortex Jan 8 00:38:53 bastion LinuxCommandsWazuh: message repeated 3 times: [ User ankur [1699779]: 493 kubectl logs -f service/vortex] Jan 8 00:39:00 bastion LinuxCommandsWazuh: User ankur [1699779]: 494 kubectl get pods | grep vortex Jan 8 00:44:45 bastion LinuxCommandsWazuh: User ankur [1699779]: 495 kubectl exec -it vortex-754684587f-ld8vj -- /bin/bash Jan 8 00:44:45 bastion LinuxCommandsWazuh: User devesh [1214493]: 490 kubectl exec -it vortex-754684587f-ld8vj -- bash Jan 8 00:44:45 bastion LinuxCommandsWazuh: User devesh [290237]: 380 kubectl logs -f vortex-754684587f-ld8vj Jan 8 00:44:45 bastion LinuxCommandsWazuh: message repeated 3 times: [ User devesh [290237]: 380 kubectl logs -f vortex-754684587f-ld8vj ] Jan 8 00:46:01 bastion LinuxCommandsWazuh: User ankur [1699779]: 496 kubectl get pods | grep vortex Jan 8 00:46:13 bastion LinuxCommandsWazuh: message repeated 6 times: [ User ankur [1699779]: 496 kubectl get pods | grep vortex] Jan 8 00:46:16 bastion LinuxCommandsWazuh: User devesh [1214493]: 490 kubectl exec -it vortex-754684587f-ld8vj -- bash Jan 8 00:46:20 bastion LinuxCommandsWazuh: message repeated 14 times: [ User devesh [1214493]: 490 kubectl exec -it vortex-754684587f-ld8vj -- bash] Jan 8 00:46:21 bastion LinuxCommandsWazuh: User devesh [1214493]: 491 clear Jan 8 00:46:58 bastion LinuxCommandsWazuh: User devesh [1214493]: 492 curl 'https://collab-svc.nitrocommerce.ai/fluenco/incentive-rule/creator/all-orgs?page=1&perpage=30&keyword=' -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0' -H 'Accept: application/json' -H 'Accept-Language: en-US,en;q=0.5' -H 'Accept-Encoding: gzip, deflate, br, zstd' -H 'Access-Control-Allow-Origin: *' -H 'token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MTc2MywibmFtZSI6ImRldmVzaCBsYWtoYW5pIiwiZW1haWwiOiJkZXZlc2grY3JlYXRvckBnZXRuaXRyby5jbyIsInVzZXJuYW1lIjoiZGV2ZXNoK2NyZWF0b3JAZ2V0bml0cm8uY28iLCJpc19hY3RpdmUiOnRydWUsImlzX3N1cGVydXNlciI6ZmFsc2UsInBhc3N3b3JkIjoicGJrZGYyX3NoYTI1NiQ2MDAwMDAkbWxqVUk0TnVhRFA5Njd1bEduVGVUSCRXQ0NLODNiWnFGS1hXM2NZdEI0dUNaRUF3OW1oZ254MjZkaFFLWThUNWcwPSIsImlzX2VtYWlsX3ZlcmlmaWVkIjp0cnVlLCJpc19waG9uZV92ZXJpZmllZCI6ZmFsc2UsInBob25lIjoiMTIzNDU2Nzg5MCIsInVzZXJfdG9rZW4iOiJjR0pyWkdZeVgzTm9ZVEkxTmlRMk1EQXdNREFrYld4cVZVazBUblZoUkZBNU5qZDFiRWR1VkdWVVNDUlhRME5MT0ROaVduRkdTMWhYTTJOWmRFSTBkVU5hUlVGM09XMW9aMjU0TWpaa2F Jan 8 00:47:06 bastion LinuxCommandsWazuh: User ankur [1699779]: 496 kubectl get pods | grep vortex Jan 8 00:47:28 bastion LinuxCommandsWazuh: message repeated 5 times: [ User ankur [1699779]: 496 kubectl get pods | grep vortex] Jan 8 00:47:39 bastion LinuxCommandsWazuh: User ankur [1699779]: 497 kubectl exec -it vortex-69b7fd96df-dwt4f -- /bin/bash Jan 8 00:48:27 bastion LinuxCommandsWazuh: User devesh [290237]: 380 kubectl logs -f vortex-754684587f-ld8vj Jan 8 00:48:30 bastion LinuxCommandsWazuh: User devesh [290237]: 381 kubectl get pods | grep vortex Jan 8 00:48:44 bastion LinuxCommandsWazuh: User devesh [290237]: 381 kubectl get pods | grep vortex Jan 8 00:48:50 bastion LinuxCommandsWazuh: User devesh [290237]: 382 kubectl get pods Jan 8 00:49:01 bastion LinuxCommandsWazuh: User devesh [290237]: 382 kubectl get pods Jan 8 00:49:17 bastion LinuxCommandsWazuh: User devesh [290237]: 382 kubectl get pods Jan 8 00:49:23 bastion LinuxCommandsWazuh: User devesh [290237]: 383 kubectl rollout restart deployments/vortex Jan 8 00:49:26 bastion LinuxCommandsWazuh: User devesh [290237]: 384 kubectl get pods Jan 8 00:49:36 bastion LinuxCommandsWazuh: message repeated 4 times: [ User devesh [290237]: 384 kubectl get pods] Jan 8 00:52:32 bastion LinuxCommandsWazuh: User ankur [1699779]: 498 kubectl get pods | grep vortex Jan 8 00:52:46 bastion LinuxCommandsWazuh: User ankur [1699779]: 499 kubectl get pods Jan 8 00:56:11 bastion LinuxCommandsWazuh: User devesh [1814508]: 488 byobu Jan 8 00:56:13 bastion LinuxCommandsWazuh: User devesh [1814508]: 489 git satus Jan 8 00:56:21 bastion LinuxCommandsWazuh: User devesh [1814508]: 490 kubectl get pods Jan 8 01:01:39 bastion LinuxCommandsWazuh: User ankur [1699779]: 500 kubectl logs -f service/vortex Jan 8 01:01:44 bastion LinuxCommandsWazuh: User devesh [194496]: 390 psql -U postgres Jan 8 01:29:13 bastion LinuxCommandsWazuh: User devesh [194496]: 391 kubectl get pods Jan 8 01:29:21 bastion LinuxCommandsWazuh: User devesh [1814508]: 491 kubectl exec -it vortex-74df895b69-lg9kg -- bash Jan 8 01:30:29 bastion LinuxCommandsWazuh: User ankur [1699779]: 500 kubectl logs -f service/vortex Jan 8 01:41:00 bastion LinuxCommandsWazuh: User devesh [194496]: 392 kubectl logs -f vortex-5f8844d4c9-6dcd6 Jan 8 01:41:00 bastion LinuxCommandsWazuh: User ankur [1699779]: 500 kubectl logs -f service/vortex Jan 8 01:41:00 bastion LinuxCommandsWazuh: User devesh [194496]: 392 kubectl logs -f vortex-5f8844d4c9-6dcd6 Jan 8 01:41:00 bastion LinuxCommandsWazuh: message repeated 2 times: [ User devesh [194496]: 392 kubectl logs -f vortex-5f8844d4c9-6dcd6] Jan 8 01:41:33 bastion LinuxCommandsWazuh: User ankur [1699779]: 500 kubectl logs -f service/vortex Jan 8 01:41:34 bastion LinuxCommandsWazuh: User devesh [194496]: 392 kubectl logs -f vortex-5f8844d4c9-6dcd6 Jan 8 01:41:38 bastion LinuxCommandsWazuh: User devesh [194496]: 393 kubectl get pods Jan 8 01:41:57 bastion LinuxCommandsWazuh: User ankur [1699779]: 500 kubectl logs -f service/vortex Jan 8 05:41:46 bastion LinuxCommandsWazuh: User devesh [194496]: 394 kubectl logs -f vortex-59ccdcd8cb-hlxpx Jan 8 05:41:46 bastion LinuxCommandsWazuh: message repeated 2 times: [ User devesh [194496]: 394 kubectl logs -f vortex-59ccdcd8cb-hlxpx] Jan 8 12:34:15 bastion LinuxCommandsWazuh: User ankur [1950940]: 500 kubectl logs -f service/vortex Jan 8 12:34:15 bastion LinuxCommandsWazuh: User devesh [1950952]: 493 byobu Jan 8 12:34:16 bastion LinuxCommandsWazuh: User ankur [1950940]: 501 ls Jan 8 12:34:36 bastion LinuxCommandsWazuh: User devesh [1950952]: 494 kubectl get configmaps vortex-config Jan 8 12:34:36 bastion LinuxCommandsWazuh: User ankur [1950940]: 502 kubectl describe configmaps vortex-config Jan 8 12:34:42 bastion LinuxCommandsWazuh: User devesh [1950952]: 495 kubectl list configmaps vortex-config Jan 8 12:34:49 bastion LinuxCommandsWazuh: User devesh [1950952]: 496 kubectl get configmaps vortex-config Jan 8 12:39:56 bastion LinuxCommandsWazuh: User ankur [1950940]: 502 kubectl describe configmaps vortex-config Jan 8 12:40:14 bastion LinuxCommandsWazuh: User ankur [1950940]: 503 kubectl logs -f service/vortex Jan 8 12:40:19 bastion LinuxCommandsWazuh: User ankur [1950940]: 504 kubectl get pods | grep vortex Jan 8 12:53:38 bastion LinuxCommandsWazuh: User ankur [1950940]: 505 kubectl logs -f vortex-59ccdcd8cb-hlxpx Jan 8 12:53:38 bastion LinuxCommandsWazuh: User ankur [1950940]: 506 . Jan 8 12:53:38 bastion LinuxCommandsWazuh: message repeated 10 times: [ User ankur [1950940]: 506 .] Jan 8 12:58:37 bastion LinuxCommandsWazuh: User ankur [1950940]: 506 . Jan 8 12:58:37 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ankur [1950940]: 506 .] Jan 8 12:58:43 bastion LinuxCommandsWazuh: User ankur [1950940]: 507 kubectl describe configmaps vortex-config Jan 8 12:58:55 bastion LinuxCommandsWazuh: User ankur [1950940]: 508 make service Jan 8 12:59:14 bastion LinuxCommandsWazuh: User ankur [1950940]: 509 kubectl describe configmaps collab-config Jan 8 12:59:20 bastion LinuxCommandsWazuh: User ankur [1950940]: 510 kubectl describe configmaps collab-api-config Jan 8 12:59:37 bastion LinuxCommandsWazuh: User ankur [1950940]: 511 kubectl get svc Jan 8 14:02:56 bastion LinuxCommandsWazuh: User ankur [1953616]: 512 exit Jan 8 14:03:06 bastion LinuxCommandsWazuh: User ankur [1953616]: 513 kubectl get svc Jan 8 14:05:20 bastion LinuxCommandsWazuh: User ankur [1953616]: 514 kubectl logs -f service/vortex Jan 8 14:05:21 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ankur [1953616]: 514 kubectl logs -f service/vortex] Jan 8 16:13:20 bastion LinuxCommandsWazuh: User ankur [1953616]: 515 psql -U postgres Jan 8 16:13:27 bastion LinuxCommandsWazuh: User ankur [1955813]: 516 exit Jan 8 16:13:28 bastion LinuxCommandsWazuh: User ankur [1955813]: 517 ls Jan 8 16:14:13 bastion LinuxCommandsWazuh: User ankur [1955813]: 518 kubectl get pods | grep vortex Jan 8 16:14:25 bastion LinuxCommandsWazuh: User venky [1956005]: 171 kubectl logs house-of-click-576cd5b7c6-nm47k Jan 8 16:14:28 bastion LinuxCommandsWazuh: User venky [1956005]: 172 ls Jan 8 16:14:37 bastion LinuxCommandsWazuh: User venky [1956005]: 173 vim README.md Jan 8 16:14:49 bastion LinuxCommandsWazuh: User venky [1956005]: 174 vim Makefile Jan 8 16:14:51 bastion LinuxCommandsWazuh: User venky [1956005]: 175 cookie-logs: Jan 8 16:15:01 bastion LinuxCommandsWazuh: User venky [1956005]: 176 make cookie-logs Jan 8 16:15:09 bastion LinuxCommandsWazuh: User venky [1956005]: 176 make cookie-logs Jan 8 16:15:19 bastion LinuxCommandsWazuh: User venky [1956005]: 177 ls Jan 8 16:15:26 bastion LinuxCommandsWazuh: User devesh [1956274]: 497 kubectl edit configmaps vortex-config Jan 8 16:15:35 bastion LinuxCommandsWazuh: User venky [1956005]: 178 vim README.md Jan 8 16:15:37 bastion LinuxCommandsWazuh: User devesh [194496]: 395 clear Jan 8 16:15:43 bastion LinuxCommandsWazuh: User venky [1956005]: 179 vim Makefile Jan 8 16:16:36 bastion LinuxCommandsWazuh: User venky [1956005]: 180 ssh 34.131.126.168 Jan 8 16:16:41 bastion LinuxCommandsWazuh: User venky [1956005]: 181 ssh ubuntu@34.131.126.168 Jan 8 16:16:56 bastion LinuxCommandsWazuh: User venky [1956005]: 181 ssh ubuntu@34.131.126.168 Jan 8 16:22:13 bastion LinuxCommandsWazuh: User devesh [290237]: 385 kubectl edit configmaps vortex-config Jan 8 16:22:22 bastion LinuxCommandsWazuh: User devesh [290237]: 386 kubectl edit configmaps cookie-cutter-config Jan 8 16:22:32 bastion LinuxCommandsWazuh: User devesh [290237]: 387 kubectl get configmaps Jan 8 16:23:01 bastion LinuxCommandsWazuh: User devesh [290237]: 388 make cookie-env Jan 8 16:23:26 bastion LinuxCommandsWazuh: User devesh [290237]: 389 vim Makefile Jan 8 16:28:42 bastion LinuxCommandsWazuh: User ankur [1955813]: 518 kubectl get pods | grep vortex Jan 8 16:45:56 bastion LinuxCommandsWazuh: User ankur [1955813]: 519 kubectl exec -it vortex-7f89788c9b-zgtgh -- bash Jan 8 16:45:59 bastion LinuxCommandsWazuh: User ankur [1955813]: 520 kubectl get pods | grep vortex Jan 8 16:51:45 bastion LinuxCommandsWazuh: User ankur [1955813]: 521 kubectl exec -it vortex-7f89788c9b-zgtgh -- bash Jan 8 16:51:47 bastion LinuxCommandsWazuh: User ankur [1955813]: 522 kubectl get pods | grep vortex Jan 8 16:52:12 bastion LinuxCommandsWazuh: User devesh [290237]: 390 kubectl edit configmaps nitrox-ck-config Jan 8 16:52:58 bastion LinuxCommandsWazuh: User devesh [290237]: 391 kubectl edit configmaps vortex-config Jan 8 16:59:51 bastion LinuxCommandsWazuh: User devesh [290237]: 392 kubectl rollout restart deployments/vortex Jan 8 17:01:40 bastion LinuxCommandsWazuh: User ankur [1955813]: 523 kubectl exec -it vortex-7f89788c9b-zgtgh -- bash Jan 8 17:05:17 bastion LinuxCommandsWazuh: User devesh [290237]: 393 kubectl edit configmaps nitrox-ck-config Jan 8 17:05:30 bastion LinuxCommandsWazuh: User devesh [290237]: 394 kubectl get pods Jan 8 17:06:05 bastion LinuxCommandsWazuh: User devesh [290237]: 394 kubectl get pods Jan 8 17:24:03 bastion LinuxCommandsWazuh: User ankur [2021691]: 524 exit Jan 8 17:24:04 bastion LinuxCommandsWazuh: User ankur [2021691]: 525 ls Jan 8 17:24:05 bastion LinuxCommandsWazuh: User ankur [2021691]: 526 l Jan 8 17:24:13 bastion LinuxCommandsWazuh: User ankur [2021691]: 527 make service Jan 8 17:24:33 bastion LinuxCommandsWazuh: User ankur [2021691]: 527 make service Jan 8 17:24:34 bastion LinuxCommandsWazuh: message repeated 3 times: [ User ankur [2021691]: 527 make service] Jan 8 17:24:39 bastion LinuxCommandsWazuh: User ankur [2021691]: 528 cat Makefile Jan 8 17:26:27 bastion LinuxCommandsWazuh: User ankur [2021691]: 529 make nitrox-bash Jan 8 17:26:41 bastion LinuxCommandsWazuh: User ankur [2021691]: 530 make nitrox-logs Jan 8 17:26:41 bastion LinuxCommandsWazuh: User ankur [2021691]: 530 make nitrox-logs Jan 8 17:26:48 bastion LinuxCommandsWazuh: User ankur [2021691]: 531 cat Makefile Jan 8 17:27:00 bastion LinuxCommandsWazuh: User ankur [2021691]: 532 kubectl logs -f service/nitrox Jan 8 17:27:14 bastion LinuxCommandsWazuh: User ankur [2021691]: 533 kubectl logs -f service/nitrox-dj Jan 8 17:27:14 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ankur [2021691]: 533 kubectl logs -f service/nitrox-dj] Jan 8 17:27:46 bastion LinuxCommandsWazuh: User ankur [2021691]: 534 kubectl logs -f service/nitrox-dj | grep facebook Jan 8 17:29:29 bastion LinuxCommandsWazuh: User ankur [2021691]: 535 kubectl logs -f service/nitrox-dj Jan 8 17:29:30 bastion LinuxCommandsWazuh: message repeated 3 times: [ User ankur [2021691]: 535 kubectl logs -f service/nitrox-dj] Jan 8 17:30:24 bastion LinuxCommandsWazuh: User ankur [2021691]: 536 psql Jan 8 17:30:31 bastion LinuxCommandsWazuh: User ankur [2021691]: 537 kubectl logs -f service/nitrox-dj Jan 8 18:00:33 bastion LinuxCommandsWazuh: User devesh [2031218]: 498 byobu Jan 8 18:11:56 bastion LinuxCommandsWazuh: User ankur [2021691]: 538 kubectl logs -f service/nitrox-dj | grep facebook Jan 8 18:11:56 bastion LinuxCommandsWazuh: message repeated 5 times: [ User ankur [2021691]: 538 kubectl logs -f service/nitrox-dj | grep facebook] Jan 8 18:17:49 bastion LinuxCommandsWazuh: User ankur [2047439]: 539 exit Jan 8 18:25:00 bastion LinuxCommandsWazuh: User devesh [1214493]: 492 curl 'https://collab-svc.nitrocommerce.ai/fluenco/incentive-rule/creator/all-orgs?page=1&perpage=30&keyword=' -H 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0' -H 'Accept: application/json' -H 'Accept-Language: en-US,en;q=0.5' -H 'Accept-Encoding: gzip, deflate, br, zstd' -H 'Access-Control-Allow-Origin: *' -H 'token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MTc2MywibmFtZSI6ImRldmVzaCBsYWtoYW5pIiwiZW1haWwiOiJkZXZlc2grY3JlYXRvckBnZXRuaXRyby5jbyIsInVzZXJuYW1lIjoiZGV2ZXNoK2NyZWF0b3JAZ2V0bml0cm8uY28iLCJpc19hY3RpdmUiOnRydWUsImlzX3N1cGVydXNlciI6ZmFsc2UsInBhc3N3b3JkIjoicGJrZGYyX3NoYTI1NiQ2MDAwMDAkbWxqVUk0TnVhRFA5Njd1bEduVGVUSCRXQ0NLODNiWnFGS1hXM2NZdEI0dUNaRUF3OW1oZ254MjZkaFFLWThUNWcwPSIsImlzX2VtYWlsX3ZlcmlmaWVkIjp0cnVlLCJpc19waG9uZV92ZXJpZmllZCI6ZmFsc2UsInBob25lIjoiMTIzNDU2Nzg5MCIsInVzZXJfdG9rZW4iOiJjR0pyWkdZeVgzTm9ZVEkxTmlRMk1EQXdNREFrYld4cVZVazBUblZoUkZBNU5qZDFiRWR1VkdWVVNDUlhRME5MT0ROaVduRkdTMWhYTTJOWmRFSTBkVU5hUlVGM09XMW9aMjU0TWpaa2F Jan 8 18:26:30 bastion LinuxCommandsWazuh: User devesh [1214493]: 493 psql -U postgres Jan 8 18:27:53 bastion LinuxCommandsWazuh: User devesh [1214493]: 494 psql Jan 8 18:27:56 bastion LinuxCommandsWazuh: User devesh [1214493]: 495 psql -U postgres Jan 8 18:28:01 bastion LinuxCommandsWazuh: User devesh [1214493]: 495 psql -U postgres Jan 8 18:28:25 bastion LinuxCommandsWazuh: User devesh [1214493]: 495 psql -U postgres Jan 8 18:35:20 bastion LinuxCommandsWazuh: User devesh [2063951]: 498 byobu Jan 8 18:35:30 bastion LinuxCommandsWazuh: User devesh [2063951]: 499 kubectl get pods Jan 8 18:36:20 bastion LinuxCommandsWazuh: User devesh [2063951]: 500 kubectl logs -f vortex-688666f67-xh9wr Jan 8 19:11:09 bastion LinuxCommandsWazuh: User ankur [2047439]: 540 psql Jan 8 19:11:50 bastion LinuxCommandsWazuh: User ankur [2098314]: 539 exit Jan 8 19:12:09 bastion LinuxCommandsWazuh: User devesh [2063951]: 501 kubectl logs -f vortex-688666f67-xh9wr | grep "Widget data dates" Jan 8 19:12:13 bastion LinuxCommandsWazuh: User ankur [2098314]: 540 kubectl get pods | grep vortex Jan 8 19:20:50 bastion LinuxCommandsWazuh: User ankur [2106993]: 539 exit Jan 8 19:20:52 bastion LinuxCommandsWazuh: User ankur [2106993]: 540 ps Jan 8 19:30:01 bastion LinuxCommandsWazuh: User ankur [2098314]: 541 kubectl exec -it vortex-7954bd9f44-xxfsp -- bash Jan 8 19:30:04 bastion LinuxCommandsWazuh: User ankur [2098314]: 542 kubectl get pods | grep vortex Jan 8 19:30:46 bastion LinuxCommandsWazuh: User ankur [2098314]: 542 kubectl get pods | grep vortex Jan 8 19:32:36 bastion LinuxCommandsWazuh: User ankur [2047439]: 541 psql -U postgres Jan 8 19:38:42 bastion LinuxCommandsWazuh: User ankur [2098314]: 543 kubectl exec -it vortex-5785dbc68c-fz2cc -- bash Jan 8 19:39:02 bastion LinuxCommandsWazuh: User ankur [2047439]: 541 psql -U postgres Jan 8 19:39:05 bastion LinuxCommandsWazuh: User ankur [2106993]: 541 psql Jan 8 21:10:02 bastion LinuxCommandsWazuh: User devesh [2127544]: 498 byobu Jan 8 21:15:27 bastion LinuxCommandsWazuh: User ubuntu [2132707]: 1521 sudo su shamailtayyab Jan 8 21:15:30 bastion LinuxCommandsWazuh: User ubuntu [2132707]: 1522 cd Jan 8 21:15:35 bastion LinuxCommandsWazuh: User ubuntu [2132707]: 1523 ls Jan 8 21:15:52 bastion LinuxCommandsWazuh: User ubuntu [2132707]: 1524 cd bin/ Jan 8 21:15:53 bastion LinuxCommandsWazuh: User ubuntu [2132707]: 1525 ls Jan 8 21:15:55 bastion LinuxCommandsWazuh: User ubuntu [2132707]: 1525 ls Jan 8 21:15:57 bastion LinuxCommandsWazuh: User ubuntu [2132707]: 1526 cd Jan 8 21:16:00 bastion LinuxCommandsWazuh: User ubuntu [2132707]: 1527 ls Jan 8 21:16:09 bastion LinuxCommandsWazuh: User ubuntu [2133441]: 1521 sudo su shamailtayyab Jan 8 21:16:11 bastion LinuxCommandsWazuh: User ubuntu [2133441]: 1522 ls Jan 8 21:16:16 bastion LinuxCommandsWazuh: User ubuntu [2133441]: 1523 cd /home Jan 8 21:16:17 bastion LinuxCommandsWazuh: User ubuntu [2133441]: 1524 ls Jan 8 21:16:32 bastion LinuxCommandsWazuh: User ubuntu [2133441]: 1525 cd /ubuntu Jan 8 21:16:39 bastion LinuxCommandsWazuh: User ubuntu [2133441]: 1526 cd ubuntu Jan 8 21:16:41 bastion LinuxCommandsWazuh: User ubuntu [2133441]: 1527 ls Jan 8 21:16:54 bastion LinuxCommandsWazuh: User ubuntu [2132707]: 1528 sudo su - ubuntu Jan 8 21:16:55 bastion LinuxCommandsWazuh: User devesh [2063951]: 502 sudo su ubuntu Jan 8 21:16:59 bastion LinuxCommandsWazuh: User devesh [2063951]: 502 sudo su ubuntu Jan 8 21:17:04 bastion LinuxCommandsWazuh: User devesh [2063951]: 503 kubectl logs -f Jan 8 21:17:11 bastion LinuxCommandsWazuh: User devesh [2063951]: 504 kubectl get pods Jan 8 21:18:26 bastion LinuxCommandsWazuh: User devesh [2063951]: 505 kubectl logs -f vortex-5785dbc68c-fz2cc Jan 8 21:18:28 bastion LinuxCommandsWazuh: User devesh [2063951]: 506 kubectl get pods Jan 8 21:18:38 bastion LinuxCommandsWazuh: User devesh [2063951]: 506 kubectl get pods Jan 8 21:18:40 bastion LinuxCommandsWazuh: message repeated 2 times: [ User devesh [2063951]: 506 kubectl get pods] Jan 8 21:52:19 bastion LinuxCommandsWazuh: User devesh [2063951]: 507 kubectl logs -f cookie-cutter-queues-7c5d48f9f6-qbc8s Jan 8 21:52:41 bastion LinuxCommandsWazuh: User devesh [2063951]: 508 kubectl logs -f cookie-cutter-queues-7c5d48f9f6-qbc8s | grep -i "Executed bg_handle_event" Jan 8 21:54:58 bastion LinuxCommandsWazuh: User devesh [2063951]: 509 kubectl logs -f cookie-cutter-queues-7c5d48f9f6-qbc8s | grep -i "Executed" Jan 8 21:55:04 bastion LinuxCommandsWazuh: User devesh [2063951]: 510 kubectl logs -f cookie-cutter-queues-7c5d48f9f6-qbc8s | grep -i "Executed facebook_identify" Jan 8 21:55:28 bastion LinuxCommandsWazuh: User devesh [2063951]: 511 kubectl logs -f cookie-cutter-queues-7c5d48f9f6-qbc8s | grep -i "Executed facebook_identify" Jan 8 22:22:09 bastion LinuxCommandsWazuh: User devesh [2063951]: 512 kubectl logs -f cookie-cutter-queues-7c5d48f9f6-qbc8s | grep -i "Executed" Jan 8 22:22:18 bastion LinuxCommandsWazuh: User devesh [2063951]: 512 kubectl logs -f cookie-cutter-queues-7c5d48f9f6-qbc8s | grep -i "Executed" Jan 8 22:22:48 bastion LinuxCommandsWazuh: User devesh [2063951]: 513 kubetail -f cookie-cutter-queues | grep -i Jan 8 22:23:00 bastion LinuxCommandsWazuh: User ubuntu [2197367]: 1534 sudo su - ubuntu Jan 8 22:23:00 bastion LinuxCommandsWazuh: User ubuntu [2197367]: 1535 sudo Jan 8 22:23:00 bastion LinuxCommandsWazuh: message repeated 2 times: [ User ubuntu [2197367]: 1535 sudo] Jan 8 22:23:04 bastion LinuxCommandsWazuh: User devesh [2197459]: 498 byobu Jan 8 22:25:12 bastion LinuxCommandsWazuh: User devesh [2063951]: 514 kubetail -f cookie-cutter-queues | grep -i "Exporter took\BG_HANDLE_EVENT_PROFILER" Jan 8 22:25:29 bastion LinuxCommandsWazuh: User devesh [2063951]: 515 kubetail -f cookie-cutter-queues | grep -i "Exporter took" Jan 8 22:25:30 bastion LinuxCommandsWazuh: message repeated 2 times: [ User devesh [2063951]: 515 kubetail -f cookie-cutter-queues | grep -i "Exporter took"] Jan 8 22:25:43 bastion LinuxCommandsWazuh: User devesh [2063951]: 516 kubetail cookie-cutter-queues | grep -i "Exporter took" Jan 8 22:26:29 bastion LinuxCommandsWazuh: User devesh [2063951]: 517 kubetail cookie-cutter-queues | grep -i "Exporter took\BG_HANDLE_EVENT_PROFILER" Jan 8 22:28:16 bastion LinuxCommandsWazuh: User devesh [2063951]: 518 kubetail cookie-cutter-queues | grep -i "Exporter took\|BG_HANDLE_EVENT_PROFILER" Jan 8 22:28:17 bastion LinuxCommandsWazuh: message repeated 2 times: [ User devesh [2063951]: 518 kubetail cookie-cutter-queues | grep -i "Exporter took\|BG_HANDLE_EVENT_PROFILER"] Jan 8 22:28:40 bastion LinuxCommandsWazuh: User devesh [2063951]: 519 kubetail cookie-cutter-queues | grep -i "Exported\|BG_HANDLE_EVENT_PROFILER" Jan 8 22:28:40 bastion LinuxCommandsWazuh: User devesh [2063951]: 519 kubetail cookie-cutter-queues | grep -i "Exported\|BG_HANDLE_EVENT_PROFILER" Jan 8 22:29:15 bastion LinuxCommandsWazuh: User devesh [2063951]: 520 kubetail cookie-cutter-queues | grep -i "Executed\|BG_HANDLE_EVENT_PROFILER" Jan 8 22:30:56 bastion LinuxCommandsWazuh: User devesh [2063951]: 521 kubetail cookie-cutter-queues | grep -i "Executed bg_handle_event\|BG_HANDLE_EVENT_PROFILER" Jan 8 22:30:56 bastion LinuxCommandsWazuh: message repeated 3 times: [ User devesh [2063951]: 521 kubetail cookie-cutter-queues | grep -i "Executed bg_handle_event\|BG_HANDLE_EVENT_PROFILER"] Jan 8 22:31:44 bastion LinuxCommandsWazuh: User devesh [2063951]: 522 kubetail cookie-cutter-queues | grep -i "exported to thirdparty" Jan 8 22:35:45 bastion LinuxCommandsWazuh: User ubuntu [2483041]: 1534 sudo su - ubuntu Jan 8 22:35:56 bastion LinuxCommandsWazuh: User devesh [2483397]: 498 byobu Jan 8 22:47:03 bastion LinuxCommandsWazuh: User devesh [2063951]: 522 kubetail cookie-cutter-queues | grep -i "exported to thirdparty" Jan 8 22:47:23 bastion LinuxCommandsWazuh: User devesh [2063951]: 523 kubetail cookie-cutter-queues | grep -i "Executed bg_handle_event\|BG_HANDLE_EVENT_PROFILER" Jan 8 22:49:34 bastion LinuxCommandsWazuh: User devesh [2063951]: 523 kubetail cookie-cutter-queues | grep -i "Executed bg_handle_event\|BG_HANDLE_EVENT_PROFILER" Jan 8 22:50:00 bastion LinuxCommandsWazuh: User devesh [2063951]: 524 kubetail cookie-cutter-queues | grep -i "Exporter\|completed" Jan 8 22:53:19 bastion LinuxCommandsWazuh: User devesh [2063951]: 525 kubetail cookie-cutter-queues | grep -i "Executed bg_handle_event.*BG_HANDLE_EVENT_PROFILER" Jan 8 22:54:32 bastion LinuxCommandsWazuh: User devesh [2063951]: 526 kubetail cookie-cutter-queues | grep -i "exporter.*completed" Jan 8 22:57:10 bastion LinuxCommandsWazuh: User devesh [2063951]: 526 kubetail cookie-cutter-queues | grep -i "exporter.*completed" Jan 8 22:57:13 bastion LinuxCommandsWazuh: message repeated 3 times: [ User devesh [2063951]: 526 kubetail cookie-cutter-queues | grep -i "exporter.*completed"] Jan 8 22:59:32 bastion LinuxCommandsWazuh: User devesh [2943516]: 498 byobu Jan 8 22:59:49 bastion LinuxCommandsWazuh: User devesh [2197459]: 498 byobu Jan 8 23:00:01 bastion LinuxCommandsWazuh: User devesh [2063951]: 526 kubetail cookie-cutter-queues | grep -i "exporter.*completed" Jan 8 23:03:09 bastion LinuxCommandsWazuh: User devesh [2063951]: 526 kubetail cookie-cutter-queues | grep -i "exporter.*completed" Jan 8 23:04:36 bastion LinuxCommandsWazuh: User devesh [3011972]: 498 byobu Jan 8 23:04:38 bastion LinuxCommandsWazuh: User devesh [3011972]: 499 ls Jan 8 23:05:08 bastion LinuxCommandsWazuh: User devesh [3011972]: 500 vim exporter_logs_8th_jan.log Jan 8 23:08:00 bastion LinuxCommandsWazuh: User devesh [3011972]: 500 vim exporter_logs_8th_jan.log Jan 8 23:08:06 bastion LinuxCommandsWazuh: User devesh [3011972]: 501 ls Jan 8 23:09:20 bastion LinuxCommandsWazuh: User devesh [2943516]: 498 byobu Jan 8 23:09:34 bastion LinuxCommandsWazuh: User devesh [2063951]: 527 kubetail cookie-cutter-queues | grep -i "exporter.*completed" 2>&1 | tee -a exporter_logs_8th_jan.log Jan 8 23:09:42 bastion LinuxCommandsWazuh: User devesh [2943516]: 498 byobu Jan 8 23:09:49 bastion LinuxCommandsWazuh: User devesh [3011972]: 502 vim exporter_logs_8th_jan.log Jan 8 23:09:55 bastion LinuxCommandsWazuh: message repeated 2 times: [ User devesh [3011972]: 502 vim exporter_logs_8th_jan.log ] Jan 8 23:10:20 bastion LinuxCommandsWazuh: User devesh [3011972]: 503 tail -f exporter_logs_8th_jan.log | grep 'fabaa053-1c4d-47fd-8ac4-5caa274acc71' Jan 8 23:10:41 bastion LinuxCommandsWazuh: User devesh [3011972]: 504 cat exporter_logs_8th_jan.log | grep 'fabaa053-1c4d-47fd-8ac4-5caa274acc71' Jan 8 23:12:20 bastion LinuxCommandsWazuh: User devesh [3011972]: 505 vim exporter_logs_8th_jan.log Jan 8 23:12:26 bastion LinuxCommandsWazuh: User devesh [3011972]: 506 cat exporter_logs_8th_jan.log | grep '6b05317e-d799-4ad8-85e8-e2abbdfa87f4' Jan 8 23:14:21 bastion LinuxCommandsWazuh: User devesh [3011972]: 506 cat exporter_logs_8th_jan.log | grep '6b05317e-d799-4ad8-85e8-e2abbdfa87f4' Jan 8 23:14:33 bastion LinuxCommandsWazuh: User devesh [2197459]: 498 byobu Jan 8 23:14:51 bastion LinuxCommandsWazuh: User devesh [3011972]: 506 cat exporter_logs_8th_jan.log | grep '6b05317e-d799-4ad8-85e8-e2abbdfa87f4' Jan 8 23:15:05 bastion LinuxCommandsWazuh: User devesh [3011972]: 507 cat exporter_logs_8th_jan.log | grep '6b05317e-d799-4ad8-85e8-e2abbdfa87f4.*664b9c6587-v7nk' Jan 8 23:15:19 bastion LinuxCommandsWazuh: User devesh [3011972]: 508 cat exporter_logs_8th_jan.log | grep '664b9c6587-v7nk.*6b05317e-d799-4ad8-85e8-e2abbdfa87f4' Jan 8 23:25:19 bastion LinuxCommandsWazuh: User devesh [3011972]: 508 cat exporter_logs_8th_jan.log | grep '664b9c6587-v7nk.*6b05317e-d799-4ad8-85e8-e2abbdfa87f4' Jan 8 23:25:29 bastion LinuxCommandsWazuh: User devesh [3011972]: 508 cat exporter_logs_8th_jan.log | grep '664b9c6587-v7nk.*6b05317e-d799-4ad8-85e8-e2abbdfa87f4' Jan 8 23:26:08 bastion LinuxCommandsWazuh: User devesh [3011972]: 509 kubetail cookie-cutter-queues | grep -P 'Exporter took (\d+\.\d+)' | awk '{if ($3 > 10) print}' Jan 8 23:27:27 bastion LinuxCommandsWazuh: User devesh [3011972]: 510 kubetail cookie-cutter-queues | grep -P 'Exporter took (\d+\.\d+)' | awk '{if ($3 + 0 > 10) print}' Jan 8 23:29:57 bastion LinuxCommandsWazuh: User devesh [3011972]: 511 kubetail cookie-cutter-queues | grep -P 'Exporter took (\d+\.\d+)' | awk '{if ($3 + 0 > 1) print}' Jan 8 23:30:12 bastion LinuxCommandsWazuh: User devesh [3011972]: 512 kubetail cookie-cutter-queues | grep -oP 'Exporter took (\d+\.\d+)' | awk '{if ($3 > 5) print}' Jan 8 23:31:12 bastion LinuxCommandsWazuh: User devesh [3011972]: 513 kubetail cookie-cutter-queues | grep -oP 'Exporter took (\d+\.\d+)' | awk '{if ($3 > 1) print}' Jan 8 23:31:13 bastion LinuxCommandsWazuh: message repeated 2 times: [ User devesh [3011972]: 513 kubetail cookie-cutter-queues | grep -oP 'Exporter took (\d+\.\d+)' | awk '{if ($3 > 1) print}'] Jan 8 23:31:50 bastion LinuxCommandsWazuh: User devesh [3011972]: 513 kubetail cookie-cutter-queues | grep -oP 'Exporter took (\d+\.\d+)' | awk '{if ($3 > 1) print}' Jan 8 23:32:03 bastion LinuxCommandsWazuh: User devesh [2063951]: 527 kubetail cookie-cutter-queues | grep -i "exporter.*completed" 2>&1 | tee -a exporter_logs_8th_jan.log Jan 8 23:32:04 bastion LinuxCommandsWazuh: User devesh [2063951]: 528 ll Jan 8 23:32:23 bastion LinuxCommandsWazuh: User devesh [2063951]: 529 mv exporter_logs_8th_jan.log exporter_logs_8th_jan.log1 Jan 8 23:32:27 bastion LinuxCommandsWazuh: message repeated 3 times: [ User devesh [2063951]: 529 mv exporter_logs_8th_jan.log exporter_logs_8th_jan.log1 ] Jan 8 23:32:49 bastion LinuxCommandsWazuh: User devesh [2063951]: 529 mv exporter_logs_8th_jan.log exporter_logs_8th_jan.log1 Jan 8 23:33:50 bastion LinuxCommandsWazuh: User devesh [3011972]: 513 kubetail cookie-cutter-queues | grep -oP 'Exporter took (\d+\.\d+)' | awk '{if ($3 > 1) print}' Jan 8 23:36:22 bastion LinuxCommandsWazuh: User devesh [3011972]: 514 vim exporter_logs_8th_jan.log Jan 8 23:36:39 bastion LinuxCommandsWazuh: User devesh [3011972]: 515 cat exporter_logs_8th_jan.log | grep -P 'completed \d+\.\d+ (\d+\.\d+)' | awk '{if ($3 > 3) print}' Jan 8 23:37:07 bastion LinuxCommandsWazuh: User devesh [3011972]: 516 cat exporter_logs_8th_jan.log | grep -P 'completed \d+\.\d+ (\d+\.\d+)' | awk '{if ($3 > 5) print}' Jan 8 23:37:10 bastion LinuxCommandsWazuh: User devesh [3011972]: 516 cat exporter_logs_8th_jan.log | grep -P 'completed \d+\.\d+ (\d+\.\d+)' | awk '{if ($3 > 5) print}' Jan 8 23:40:13 bastion LinuxCommandsWazuh: User devesh [2063951]: 530 kubetail cookie-cutter-queues | grep -i "exporter.*completed" 2>&1 | tee -a exporter_logs_8th_jan.log Jan 8 23:40:13 bastion LinuxCommandsWazuh: message repeated 3 times: [ User devesh [2063951]: 530 kubetail cookie-cutter-queues | grep -i "exporter.*completed" 2>&1 | tee -a exporter_logs_8th_jan.log] Jan 8 23:41:35 bastion LinuxCommandsWazuh: User devesh [3011972]: 516 cat exporter_logs_8th_jan.log | grep -P 'completed \d+\.\d+ (\d+\.\d+)' | awk '{if ($3 > 5) print}' Jan 8 23:41:36 bastion LinuxCommandsWazuh: message repeated 4 times: [ User devesh [3011972]: 516 cat exporter_logs_8th_jan.log | grep -P 'completed \d+\.\d+ (\d+\.\d+)' | awk '{if ($3 > 5) print}'] Jan 8 23:43:46 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 695 k get pods Jan 8 23:43:48 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 695 k get pods Jan 8 23:43:49 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 696 ls Jan 8 23:44:07 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 696 ls Jan 8 23:44:12 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 697 kubectl logs -f cookie-cutter-queues-5b5b97cfb8-kjdw5 | grep 'High Recent Failure Rate' Jan 8 23:44:21 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 697 kubectl logs -f cookie-cutter-queues-5b5b97cfb8-kjdw5 | grep 'High Recent Failure Rate' Jan 8 23:44:21 bastion LinuxCommandsWazuh: message repeated 3 times: [ User shamailtayyab [893265]: 697 kubectl logs -f cookie-cutter-queues-5b5b97cfb8-kjdw5 | grep 'High Recent Failure Rate'] Jan 8 23:44:28 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 697 kubectl logs -f cookie-cutter-queues-5b5b97cfb8-kjdw5 | grep 'High Recent Failure Rate' Jan 8 23:44:31 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 698 kubectl get logs Jan 8 23:44:34 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 699 kubectl get pods Jan 8 23:44:37 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 700 kubectl get pods | grep queue Jan 8 23:45:36 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 701 kubectl logs -f cookie-cutter-queues-78cc67965d-6pklj | grep 'High Recent Failure Rate' Jan 8 23:45:39 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 701 kubectl logs -f cookie-cutter-queues-78cc67965d-6pklj | grep 'High Recent Failure Rate' Jan 8 23:45:42 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 702 history | grep grep Jan 8 23:45:50 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 702 history | grep grep Jan 8 23:46:57 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 703 kubectl logs -f cookie-cutter-queues-78cc67965d-6pklj | grep 'Exporter took' Jan 8 23:46:59 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 704 history | grep grep Jan 8 23:47:31 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 705 kubectl logs -f cookie-cutter-queues-78cc67965d-6pklj | grep 'Child Failed for' Jan 8 23:49:11 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 706 kubectl logs -f cookie-cutter-queues-78cc67965d-6pklj | grep 'Exception' Jan 8 23:49:23 bastion LinuxCommandsWazuh: User shamailtayyab [893265]: 707 kubectl logs -f cookie-cutter-queues-78cc67965d-6pklj | grep 'Exporter took'