/etc/passwd has been changed

[lnxadm-morth]

O/S:-RHEL 7.5
Version:-Zabbix 4.0
no one has change in /etc/password file but many time we are getting the alert "/etc/passwd has been changed" . kindly help us

[dimir]

Check the modification time of the file. ssh to the host where Zabbix agent is running and execute:

$ ls -l /etc/passwd
-rw-r--r-- 1 root root 2614 Apr 26  2018 /etc/passwd

[lnxadm-morth]

Hi Dimir,
Thx for replying

[root@------------- ~]# ls -l /etc/passwd
-rw-r--r-- 1 root root 2256 Dec 5 18:06 /etc/passwd

yes it has been change the time stamp. but who has change the time stamp

[dimir]

You know it wasn't me. ;-)

[Atsushi]

Even if you do not explicitly add or remove users, users may be created for that package automatically when you install some packages.
Did not install any package before the failure was detected?

[lnxadm-morth]

Hi Atsushi,

i did not install any package , i am not getting the point why this triggers has been occurred and who has triggered and what was the reason

[Atsushi]

Please check the /var/log/audit/audit.log file.

[lnxadm-morth]

Hi Atsushi,

time stamp is not showing in audit log file to check the issue

[Atsushi]

Are you checking not only about the timing of detection of faults but also about 1 hour ago?

If you do not have it in the log, please check with everyone who was accessing during the applicable time period.

[ingus.vilnis]

If that item is configured as "Zabbix agent (active)" then multiple hosts might be misconfigured to appear as one and send data to one host in Zabbix.