Security issue with Zabbix?

[Niro]

I'm running a few EC2/Scalr instances with zabbix monitoring.
I received complaints about one of my servers port scanning other servers. the logs show it is accessing port 22 on consecutive IP addresses.

I looked at the processes list and saw scanssh is running under the user Zabbix.

My question is- Is scanssh part of zabbix? Is it suppesd to run?
I have active autodiscovery on zabbix but it is looking at another IP addresses and definately not port 20.
Is it possible that something in the config of zabbix agent is controlling it and not the settings on zabbix server?

What can I do to find out if zabbix is somehow misbehaving or it is a hacker?
Any advice is highly appreciated.

[nelsonab]

Do you have network discovery running?

Heh... reread and answered my on question... Double check your parameters, try some different values.

[Niro]

Let me rephrase my question

I see Scanssh processes owned by zabbix user. Is it normal?
If it isn't I assume that Zabbix user has been compromised. How can I prevent it in the future?