1. 用df 检查发现根目录可用空间越为200M
# df -h Filesystem Size Used Avail Use% Mounted on /dev/xvde1 9.9G 9.4G 232M 36% / none 7.4G 16K 7.4G 1% /dev/shm
2. 用du命令查看根目录各子目录占用空间,可以发现6G的空间莫名其妙地丢了
# du -sm /* | sort -nr | head 1755 /usr 664 /var 538 /lib 331 /opt 104 /boot 31 /etc 23 /lib64 14 /sbin 9 /bin
3. 用lsof命令查看有很多处于deleted状态的进程
# lsof | grep delete cbdaemon 993 root 5w REG 202,65 388 65623 /var/log/cb/sensor/cbdaemon.ec2s-usercassandra-02.invalid-user.log.ERROR.20170713-143157.993 (deleted) salt-mini 1761 root 0r REG 202,65 17 16389 /tmp/sh-thd-1499978414 (deleted) salt-mini 1761 root 6w REG 202,65 265 347691 /var/log/salt/minion-20170714 (deleted) salt-mini 1762 root 0r REG 202,65 17 16389 /tmp/sh-thd-1499978414 (deleted) salt-mini 1762 root 6w REG 202,65 265 347691 /var/log/salt/minion-20170714 (deleted) filebeat 1852 root 10r REG 202,65 6292254 75366 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 12r REG 202,65 6291461 74061 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 14r REG 202,65 6291523 74051 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 15r REG 202,65 6291516 74050 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 16r REG 202,65 6291575 74052 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 17r REG 202,65 6291508 74049 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 18r REG 202,65 6291824 74053 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 19r REG 202,65 6291512 74054 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 20r REG 202,65 6291532 73882 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 21r REG 202,65 6291532 74055 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 22r REG 202,65 6291515 74057 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 23r REG 202,65 6291727 74080 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 24r REG 202,65 6291579 74058 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 25r REG 202,65 6291480 74082 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 26r REG 202,65 6291557 74081 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 27r REG 202,65 6291600 74083 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 28r REG 202,65 6291469 74084 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 30r REG 202,65 6291671 74085 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 31r REG 202,65 6291582 74086 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 32r REG 202,65 6291638 74104 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 33r REG 202,65 6291482 74087 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 34r REG 202,65 6291550 74090 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 35r REG 202,65 6292253 74091 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 36r REG 202,65 6291611 74092 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 37r REG 202,65 6292214 74093 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 38r REG 202,65 6291609 74089 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 39r REG 202,65 6291657 74094 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 40r REG 202,65 6291488 74095 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 41r REG 202,65 6291514 74105 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 42r REG 202,65 6291637 74106 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 43r REG 202,65 6291523 74164 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 44r REG 202,65 6291550 74107 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 45r REG 202,65 6292096 74110 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 46r REG 202,65 6291683 74109 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 47r REG 202,65 6291472 74112 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 48r REG 202,65 6291722 74111 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 49r REG 202,65 6291556 74113 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 50r REG 202,65 6291602 74114 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 51r REG 202,65 6292367 74108 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 52r REG 202,65 6291662 74115 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 53r REG 202,65 6291531 74116 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 54r REG 202,65 6291555 74117 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 55r REG 202,65 6291599 74120 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 56r REG 202,65 6291532 74119 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 57r REG 202,65 6291470 74121 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 58r REG 202,65 6291635 74122 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 59r REG 202,65 6291533 74123 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 60r REG 202,65 6291508 74124 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 61r REG 202,65 6291578 74125 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 62r REG 202,65 6291638 74127 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 63r REG 202,65 6291514 74126 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 64r REG 202,65 6291668 74146 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 65r REG 202,65 6291520 74118 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 66r REG 202,65 6291595 74144 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 67r REG 202,65 6291584 74148 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 68r REG 202,65 6291520 74147 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 69r REG 202,65 6291458 74150 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 70r REG 202,65 6291496 74149 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 71r REG 202,65 6291475 74151 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 72r REG 202,65 6291488 74161 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 73r REG 202,65 6291485 74160 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 74r REG 202,65 6291545 74162 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 75r REG 202,65 6291567 74145 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 76r REG 202,65 6291514 74170 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 77r REG 202,65 6291558 74165 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 78r REG 202,65 6291460 74166 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 79r REG 202,65 6291557 74167 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 80r REG 202,65 6291599 74168 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 81r REG 202,65 6291577 74182 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 82r REG 202,65 6292951 74169 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 83r REG 202,65 6291580 74163 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 84r REG 202,65 6291520 74171 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 85r REG 202,65 6291564 74172 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 86r REG 202,65 6291535 74173 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 87r REG 202,65 6291508 74175 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 88r REG 202,65 6291495 74176 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 89r REG 202,65 6291462 74177 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 90r REG 202,65 6291681 74190 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 91r REG 202,65 6292766 74178 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 92r REG 202,65 6291674 74179 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 93r REG 202,65 6291517 74180 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 94r REG 202,65 6291460 74181 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 95r REG 202,65 6291551 74174 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 97r REG 202,65 6291529 74183 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 99r REG 202,65 6291733 74185 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 100r REG 202,65 6291552 74186 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 101r REG 202,65 6291530 74187 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 102r REG 202,65 6291505 74189 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 103r REG 202,65 6291481 74188 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 104r REG 202,65 6291502 74192 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 105r REG 202,65 6291664 74191 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 106r REG 202,65 6291476 74209 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 107r REG 202,65 6291490 74225 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 108r REG 202,65 6291466 74184 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 109r REG 202,65 6291619 74210 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 110r REG 202,65 6292652 74212 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 111r REG 202,65 6291488 74213 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 112r REG 202,65 6292775 74214 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 113r REG 202,65 6291766 74231 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 114r REG 202,65 6291515 74215 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 115r REG 202,65 6291533 74216 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 116r REG 202,65 6292788 74227 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 117r REG 202,65 6291691 74226 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 118r REG 202,65 6291609 74228 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 119r REG 202,65 6291634 74211 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 120r REG 202,65 6291534 74230 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 121r REG 202,65 6291457 74232 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 122r REG 202,65 6291461 74233 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 123r REG 202,65 6291486 74235 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 124r REG 202,65 6291623 74234 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 125r REG 202,65 6292321 74237 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 126r REG 202,65 6291456 74236 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 128r REG 202,65 6294897 74238 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 129r REG 202,65 6291538 74243 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 130r REG 202,65 6291468 74239 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 131r REG 202,65 6291463 74229 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 132r REG 202,65 6291590 74241 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 133r REG 202,65 6291499 74242 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 134r REG 202,65 6291471 74251 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 135r REG 202,65 6291687 74244 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 136r REG 202,65 6291701 74247 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 137r REG 202,65 6291552 74245 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 138r REG 202,65 6291499 74246 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 139r REG 202,65 6291539 74248 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 140r REG 202,65 6292354 74240 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 141r REG 202,65 6291520 74249 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 142r REG 202,65 6291459 74265 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 143r REG 202,65 6291478 74252 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 144r REG 202,65 6291528 74254 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 145r REG 202,65 6292081 74253 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 146r REG 202,65 6291626 74255 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 147r REG 202,65 6291493 74257 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 148r REG 202,65 6291583 74256 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 149r REG 202,65 6291620 74259 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 150r REG 202,65 6293089 74258 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 151r REG 202,65 6291497 74260 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 152r REG 202,65 6291583 74261 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 153r REG 202,65 6291532 74250 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 154r REG 202,65 6291575 74262 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 155r REG 202,65 6291487 74264 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 156r REG 202,65 6291602 74270 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 157r REG 202,65 6291488 74268 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 158r REG 202,65 6293081 74266 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 159r REG 202,65 6291460 74267 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 160r REG 202,65 6291604 74284 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 161r REG 202,65 6291543 74269 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 162r REG 202,65 6291542 74271 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 163r REG 202,65 6291736 74272 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 164r REG 202,65 6291701 74263 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 165r REG 202,65 6291514 74290 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 166r REG 202,65 6291508 74282 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 167r REG 202,65 6291639 74283 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 168r REG 202,65 6291508 74285 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 169r REG 202,65 6291548 74286 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 170r REG 202,65 6291514 74288 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 171r REG 202,65 6291574 74289 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 172r REG 202,65 6291463 74297 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 173r REG 202,65 6291573 74291 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 174r REG 202,65 6291473 74281 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 175r REG 202,65 6291642 74292 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 176r REG 202,65 6291584 74300 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 177r REG 202,65 6291490 74294 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 178r REG 202,65 6291525 74299 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 179r REG 202,65 6291773 74298 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 180r REG 202,65 6291663 74349 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 181r REG 202,65 6291560 74302 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 182r REG 202,65 6291488 74301 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 183r REG 202,65 6291486 74303 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 184r REG 202,65 6291514 74293 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 185r REG 202,65 6291519 74304 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 186r REG 202,65 6291512 74308 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 187r REG 202,65 6291745 74306 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 188r REG 202,65 6291589 74307 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 189r REG 202,65 6291540 74309 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 190r REG 202,65 6291507 74312 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 191r REG 202,65 6291695 74310 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 192r REG 202,65 6291546 74311 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 193r REG 202,65 6291473 74313 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 194r REG 202,65 6293095 74305 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 195r REG 202,65 6291661 74314 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 196r REG 202,65 6291539 74315 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 197r REG 202,65 6292134 74317 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 198r REG 202,65 6291562 74318 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 199r REG 202,65 6291519 74319 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 200r REG 202,65 6292245 74320 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 201r REG 202,65 6291571 74321 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 202r REG 202,65 6291513 74323 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 203r REG 202,65 6291572 74322 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 204r REG 202,65 6291503 74324 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 205r REG 202,65 6291491 74316 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 206r REG 202,65 6291548 74325 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 207r REG 202,65 6291485 74326 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 208r REG 202,65 6291689 74328 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 209r REG 202,65 6291642 74330 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 210r REG 202,65 6291507 74329 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 211r REG 202,65 6291476 74331 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 212r REG 202,65 6291489 74333 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 213r REG 202,65 6291568 74332 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 214r REG 202,65 6291494 74334 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 215r REG 202,65 6291537 74335 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 216r REG 202,65 6291676 74346 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 217r REG 202,65 6291769 74327 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 218r REG 202,65 6291573 74336 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 219r REG 202,65 6291464 74364 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 220r REG 202,65 6291720 74347 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 221r REG 202,65 6291591 74348 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 222r REG 202,65 6291571 74350 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 223r REG 202,65 6291695 74351 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 224r REG 202,65 6294877 74352 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 225r REG 202,65 6291646 74361 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 226r REG 202,65 6291460 74345 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 227r REG 202,65 6291559 74363 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 228r REG 202,65 6291642 74362 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 229r REG 202,65 6291572 74365 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 230r REG 202,65 6291461 74367 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 231r REG 202,65 6291463 74368 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 232r REG 202,65 6291477 74385 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 233r REG 202,65 6291577 74378 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 234r REG 202,65 6291469 74386 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 235r REG 202,65 6291563 74387 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 236r REG 202,65 6291586 74388 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 237r REG 202,65 6291459 74419 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 238r REG 202,65 6291472 74389 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 239r REG 202,65 6291533 74402 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 240r REG 202,65 6291650 74391 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 241r REG 202,65 6291761 74392 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 242r REG 202,65 6291546 74393 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 243r REG 202,65 6291519 74403 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 244r REG 202,65 6291626 74404 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 245r REG 202,65 6291469 74405 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 246r REG 202,65 6291485 74406 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 247r REG 202,65 6291542 74407 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 248r REG 202,65 6291481 74390 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 249r REG 202,65 6291472 74408 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 250r REG 202,65 6291635 74416 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 251r REG 202,65 6291569 74417 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 252r REG 202,65 6291504 74423 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 253r REG 202,65 6291506 74418 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 254r REG 202,65 6291491 74420 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 255r REG 202,65 6291631 74422 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 256r REG 202,65 6291457 74421 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 257r REG 202,65 6293562 74431 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 258r REG 202,65 6291515 74409 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 259r REG 202,65 6291524 74424 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 260r REG 202,65 6291524 74426 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 261r REG 202,65 6293171 74427 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 262r REG 202,65 6291521 74429 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 263r REG 202,65 6291563 74428 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 264r REG 202,65 6291550 74430 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 265r REG 202,65 6291578 74446 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 266r REG 202,65 6291596 74433 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 267r REG 202,65 6291543 74432 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 268r REG 202,65 6291981 74434 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 269r REG 202,65 6291551 74435 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 270r REG 202,65 6291512 74425 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 271r REG 202,65 6291522 74437 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 272r REG 202,65 6292721 74438 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 273r REG 202,65 6291525 74443 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 274r REG 202,65 6291738 74441 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 275r REG 202,65 6291492 74444 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 276r REG 202,65 6291743 74445 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 277r REG 202,65 6291726 74452 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 278r REG 202,65 6291544 74447 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 279r REG 202,65 6291456 74436 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 280r REG 202,65 6291773 74448 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 281r REG 202,65 6291488 74450 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 282r REG 202,65 6291623 74451 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 283r REG 202,65 6291540 74449 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 284r REG 202,65 6291591 74453 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 285r REG 202,65 6291539 74455 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 286r REG 202,65 6293395 74454 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 287r REG 202,65 6291496 74456 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 288r REG 202,65 6293733 74457 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 289r REG 202,65 6291572 74458 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 290r REG 202,65 6291497 74460 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 291r REG 202,65 6291786 74459 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 292r REG 202,65 6291477 74463 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 293r REG 202,65 6291556 74461 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 294r REG 202,65 6291517 74462 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 295r REG 202,65 6291530 74464 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 296r REG 202,65 6291563 74465 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 297r REG 202,65 6291486 74467 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 298r REG 202,65 6291503 74466 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 299r REG 202,65 6291527 74482 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 300r REG 202,65 6291475 74468 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 301r REG 202,65 6292246 74469 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 302r REG 202,65 6291569 74471 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 303r REG 202,65 6291576 74472 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 304r REG 202,65 6291465 74474 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 305r REG 202,65 6291482 74473 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 306r REG 202,65 6291776 74478 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 307r REG 202,65 6291485 74496 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 308r REG 202,65 6292242 74479 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 309r REG 202,65 6291551 74491 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 310r REG 202,65 6291505 74492 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 311r REG 202,65 6291492 74493 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 312r REG 202,65 6291584 74470 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 313r REG 202,65 6291550 74495 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 314r REG 202,65 6291472 74503 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 315r REG 202,65 6291570 74497 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 316r REG 202,65 6291770 74498 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 317r REG 202,65 6291477 74499 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 318r REG 202,65 6291542 74506 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 319r REG 202,65 6291616 74523 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 320r REG 202,65 6291560 74507 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 321r REG 202,65 6291523 74520 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 324r REG 202,65 6291671 74517 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 325r REG 202,65 6291502 74494 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 326r REG 202,65 6291456 74518 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 327r REG 202,65 6291587 74521 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 328r REG 202,65 6291465 74522 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 329r REG 202,65 6291691 74528 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 330r REG 202,65 6291492 74525 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 331r REG 202,65 6291479 74524 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 332r REG 202,65 6291513 74526 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 333r REG 202,65 6291570 74519 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 334r REG 202,65 6291562 74527 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 335r REG 202,65 6291540 74585 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 336r REG 202,65 6291498 74530 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 337r REG 202,65 6291704 74531 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 338r REG 202,65 6291468 74532 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 339r REG 202,65 6291709 74567 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 340r REG 202,65 6291601 74565 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 341r REG 202,65 6293578 74566 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 342r REG 202,65 6291579 74568 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 343r REG 202,65 6291525 74569 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 344r REG 202,65 6291692 74529 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 345r REG 202,65 6291602 74570 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 346r REG 202,65 6291572 74581 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 347r REG 202,65 6291467 74572 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 348r REG 202,65 6291521 74582 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 349r REG 202,65 6291633 74583 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 350r REG 202,65 6291769 74584 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 352r REG 202,65 6291551 74586 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 353r REG 202,65 6291628 74587 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 354r REG 202,65 6291567 74588 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 355r REG 202,65 6291765 74595 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 356r REG 202,65 6293336 74571 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 357r REG 202,65 6291509 74621 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 358r REG 202,65 6291461 74594 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 359r REG 202,65 6291493 74670 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 360r REG 202,65 6291497 74677 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 361r REG 202,65 6291713 74671 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 362r REG 202,65 6292711 74674 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 363r REG 202,65 6291465 74678 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 364r REG 202,65 6291906 74679 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 365r REG 202,65 6291560 74682 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 366r REG 202,65 6291523 74680 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 367r REG 202,65 6291609 74683 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 368r REG 202,65 6291505 74681 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 369r REG 202,65 6291504 74684 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 370r REG 202,65 6291756 74686 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 371r REG 202,65 6291565 74685 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 372r REG 202,65 6291561 74689 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 373r REG 202,65 6291739 74690 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 374r REG 202,65 6291562 74691 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 375r REG 202,65 6291533 74692 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 376r REG 202,65 6291506 74694 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 377r REG 202,65 6291555 74693 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 378r REG 202,65 6291574 74710 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 379r REG 202,65 6291632 74699 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 380r REG 202,65 6291467 74709 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 381r REG 202,65 6291459 74743 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 382r REG 202,65 6291765 74714 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 383r REG 202,65 6291557 74711 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 384r REG 202,65 6291523 74713 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 385r REG 202,65 6291465 74715 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 386r REG 202,65 6291477 74716 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 387r REG 202,65 6291458 74740 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 388r REG 202,65 6291528 74717 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 389r REG 202,65 6291511 74697 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 390r REG 202,65 6291494 74734 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 391r REG 202,65 6291577 74747 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 392r REG 202,65 6291520 74741 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 393r REG 202,65 6291730 74745 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 394r REG 202,65 6291542 74748 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 395r REG 202,65 6291543 74771 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 396r REG 202,65 6291474 74749 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 397r REG 202,65 6291948 74750 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 398r REG 202,65 6291561 74735 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 399r REG 202,65 6291707 74751 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 400r REG 202,65 6292634 74754 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 401r REG 202,65 6291647 74755 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 402r REG 202,65 6291678 74758 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 403r REG 202,65 6291571 74761 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 404r REG 202,65 6291469 74763 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 405r REG 202,65 6291746 74767 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 406r REG 202,65 6291681 74829 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 407r REG 202,65 6291551 74769 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 408r REG 202,65 6293667 74753 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 409r REG 202,65 6292465 74777 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 410r REG 202,65 6291576 74775 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 411r REG 202,65 6291660 74778 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 412r REG 202,65 6293407 74785 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 413r REG 202,65 6291681 74786 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 414r REG 202,65 6292536 74787 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 415r REG 202,65 6291722 74789 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 416r REG 202,65 6291568 74788 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 417r REG 202,65 6291713 74792 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 418r REG 202,65 6291463 74790 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 419r REG 202,65 6291868 74796 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 420r REG 202,65 6291547 74776 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 421r REG 202,65 6293517 74814 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 422r REG 202,65 6291779 74813 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 423r REG 202,65 6291512 74815 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 424r REG 202,65 6291718 74828 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 425r REG 202,65 6291460 74843 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 426r REG 202,65 6291656 74830 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 427r REG 202,65 6291508 74836 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 428r REG 202,65 6291504 74837 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 429r REG 202,65 6291559 74812 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 430r REG 202,65 6291533 74841 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 431r REG 202,65 6291527 74842 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 432r REG 202,65 6291568 74845 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 433r REG 202,65 6291458 74844 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 434r REG 202,65 6291489 74846 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 435r REG 202,65 6291456 74847 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 436r REG 202,65 6291583 74867 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 437r REG 202,65 6291681 74868 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 438r REG 202,65 6291503 74870 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 439r REG 202,65 6291490 74869 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 440r REG 202,65 6291549 74898 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 441r REG 202,65 6291780 74871 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 442r REG 202,65 6291483 74875 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 443r REG 202,65 6291505 74878 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 444r REG 202,65 6291487 74876 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 445r REG 202,65 6291516 74887 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 446r REG 202,65 6292717 74889 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 447r REG 202,65 6291722 74890 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 448r REG 202,65 6291667 74891 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 449r REG 202,65 6291498 74893 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 450r REG 202,65 6296396 74872 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 451r REG 202,65 6291489 74895 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 452r REG 202,65 6293138 74911 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 453r REG 202,65 6291462 74899 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 454r REG 202,65 6291550 74901 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 455r REG 202,65 6291547 74902 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 456r REG 202,65 6291570 74905 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 457r REG 202,65 6291894 74903 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 458r REG 202,65 6293531 74904 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 459r REG 202,65 6291495 74897 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 460r REG 202,65 6291507 74906 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 461r REG 202,65 6291475 74907 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 462r REG 202,65 6291701 74908 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 463r REG 202,65 6291557 74910 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 464r REG 202,65 6291490 74909 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 465r REG 202,65 6291456 74912 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 466r REG 202,65 6291588 74913 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 467r REG 202,65 6292910 74914 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 468r REG 202,65 6291478 74915 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 469r REG 202,65 6291542 74930 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 470r REG 202,65 6291526 74916 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 471r REG 202,65 6291766 74917 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 472r REG 202,65 6291512 74918 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 473r REG 202,65 6291536 74929 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 474r REG 202,65 6291712 74927 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 475r REG 202,65 6291482 74976 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 476r REG 202,65 6291531 74931 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 477r REG 202,65 6291509 74932 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 478r REG 202,65 6291557 74933 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 479r REG 202,65 6291609 74934 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 480r REG 202,65 6291715 74944 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 481r REG 202,65 6291555 74946 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 482r REG 202,65 6291527 74949 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 483r REG 202,65 6291659 74928 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 484r REG 202,65 6291685 74950 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 485r REG 202,65 6291586 74960 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 486r REG 202,65 6291756 74961 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 487r REG 202,65 6291497 74962 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 488r REG 202,65 6291543 74965 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 489r REG 202,65 6291560 74963 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 490r REG 202,65 6291573 74964 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 491r REG 202,65 6291654 74966 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 492r REG 202,65 6291492 74967 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 493r REG 202,65 6291518 74968 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 494r REG 202,65 6292557 74959 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 495r REG 202,65 6291492 74970 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 496r REG 202,65 6291486 74971 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 497r REG 202,65 6291592 74972 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 498r REG 202,65 6291531 74974 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 499r REG 202,65 6291585 74973 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 500r REG 202,65 6291686 74975 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 501r REG 202,65 6291497 74993 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 502r REG 202,65 6291528 74977 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 503r REG 202,65 6291492 74978 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 504r REG 202,65 6291469 74969 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 505r REG 202,65 6291538 74979 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 506r REG 202,65 6291533 74983 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 507r REG 202,65 6291457 74981 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 508r REG 202,65 6293448 74982 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 509r REG 202,65 6291487 74984 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 510r REG 202,65 6291773 74986 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 511r REG 202,65 6291664 74985 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 512r REG 202,65 6291576 74987 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 513r REG 202,65 6291687 74988 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 514r REG 202,65 6291579 74989 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 515r REG 202,65 6291482 74980 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 516r REG 202,65 6291487 74990 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 517r REG 202,65 6291632 74992 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 518r REG 202,65 6291540 74994 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 519r REG 202,65 6291478 75010 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 520r REG 202,65 6291466 74995 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 521r REG 202,65 6291541 74997 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 522r REG 202,65 6291504 74996 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 523r REG 202,65 6291493 74999 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 524r REG 202,65 6291523 74998 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 525r REG 202,65 6291505 74991 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 526r REG 202,65 6291528 75009 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 527r REG 202,65 6291478 75007 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 528r REG 202,65 6291575 75023 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 529r REG 202,65 6291573 75011 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 530r REG 202,65 6291846 75012 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 531r REG 202,65 6291714 75014 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 532r REG 202,65 6291487 75013 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 533r REG 202,65 6291639 75015 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 534r REG 202,65 6291577 75016 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 535r REG 202,65 6291579 75017 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 536r REG 202,65 6291655 75018 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 537r REG 202,65 6291538 75008 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 538r REG 202,65 6291557 75020 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 539r REG 202,65 6293106 75021 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 540r REG 202,65 6291505 75022 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 541r REG 202,65 6291543 75075 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 542r REG 202,65 6291526 75025 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 543r REG 202,65 6291512 75024 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 544r REG 202,65 6291561 75026 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 545r REG 202,65 6291573 75027 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 547r REG 202,65 6291504 75019 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 548r REG 202,65 6291482 75030 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 550r REG 202,65 6291481 75028 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 551r REG 202,65 6291618 75048 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 552r REG 202,65 6291551 75031 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 553r REG 202,65 6291495 75049 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 554r REG 202,65 6291511 75050 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 555r REG 202,65 6291523 75052 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 556r REG 202,65 6291641 75051 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 557r REG 202,65 6291533 75029 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 558r REG 202,65 6291520 75053 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 559r REG 202,65 6291552 75054 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 560r REG 202,65 6291567 75055 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 561r REG 202,65 6291538 75076 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 562r REG 202,65 6291718 75073 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 563r REG 202,65 6291456 75074 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 564r REG 202,65 6291539 75090 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 565r REG 202,65 6291510 75088 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 566r REG 202,65 6291459 75079 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 567r REG 202,65 6291485 75089 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 568r REG 202,65 6291497 75091 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 569r REG 202,65 6291483 75072 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 570r REG 202,65 6291500 75093 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 571r REG 202,65 6291754 75094 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 572r REG 202,65 6291501 75092 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 573r REG 202,65 6291525 75095 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 574r REG 202,65 6291642 75096 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 575r REG 202,65 6291462 75077 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 576r REG 202,65 6291473 75107 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 577r REG 202,65 6291551 75105 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 578r REG 202,65 6291482 75108 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 579r REG 202,65 6292260 75110 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 580r REG 202,65 6291709 75109 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 582r REG 202,65 6291466 75120 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 583r REG 202,65 6291479 75112 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 584r REG 202,65 6291878 75113 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 585r REG 202,65 6291530 75114 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 586r REG 202,65 6291485 75115 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 587r REG 202,65 6291522 75106 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 588r REG 202,65 6291648 75117 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 589r REG 202,65 6291752 75118 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 590r REG 202,65 6291493 75119 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 591r REG 202,65 6291517 75124 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 592r REG 202,65 6291576 75111 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 593r REG 202,65 6291548 75121 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 594r REG 202,65 6291523 75128 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 595r REG 202,65 6291620 75123 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 596r REG 202,65 6291464 75125 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 597r REG 202,65 6291581 75116 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 598r REG 202,65 6291529 75129 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 599r REG 202,65 6292718 75126 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 600r REG 202,65 6291549 75142 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 601r REG 202,65 6291680 75122 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 602r REG 202,65 6291506 75138 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 603r REG 202,65 6291467 75140 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 604r REG 202,65 6293122 75141 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 605r REG 202,65 6293203 75127 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 606r REG 202,65 6291569 75143 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 607r REG 202,65 6291538 75161 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 608r REG 202,65 6291550 75155 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 609r REG 202,65 6291657 75145 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 610r REG 202,65 6291491 75154 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 611r REG 202,65 6291488 75156 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 612r REG 202,65 6291468 75157 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 613r REG 202,65 6291577 75139 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 614r REG 202,65 6291559 75160 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 615r REG 202,65 6291469 75159 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 616r REG 202,65 6291610 75196 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 617r REG 202,65 6291777 75144 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 618r REG 202,65 6291485 75190 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 619r REG 202,65 6291477 75188 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 620r REG 202,65 6293584 75191 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 621r REG 202,65 6291577 75192 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 622r REG 202,65 6291567 75158 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 623r REG 202,65 6291489 75193 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 624r REG 202,65 6291555 75202 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 625r REG 202,65 6291468 75195 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 626r REG 202,65 6291953 75197 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 627r REG 202,65 6291706 75198 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 628r REG 202,65 6291770 75189 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 629r REG 202,65 6291495 75199 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 630r REG 202,65 6291571 75201 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 631r REG 202,65 6291491 75194 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 632r REG 202,65 6291479 75203 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 633r REG 202,65 6291477 75219 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 634r REG 202,65 6291738 75204 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 635r REG 202,65 6291486 75206 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 636r REG 202,65 6292765 75208 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 637r REG 202,65 6291763 75207 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 638r REG 202,65 6293685 75200 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 639r REG 202,65 6291479 75209 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 640r REG 202,65 6291479 75211 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 641r REG 202,65 6291493 75212 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 642r REG 202,65 6291465 75213 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 643r REG 202,65 6291641 75214 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 644r REG 202,65 6291657 75215 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 645r REG 202,65 6291717 75205 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 646r REG 202,65 6291520 75218 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 647r REG 202,65 6293268 75217 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 648r REG 202,65 6291723 75225 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 649r REG 202,65 6292022 75220 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 650r REG 202,65 6293473 75210 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 651r REG 202,65 6291568 75222 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 652r REG 202,65 6291712 75223 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 653r REG 202,65 6291490 75224 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 654r REG 202,65 6291491 75227 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 655r REG 202,65 6291458 75216 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 656r REG 202,65 6291570 75229 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 657r REG 202,65 6291605 75246 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 658r REG 202,65 6291576 75228 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 659r REG 202,65 6291720 75221 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 660r REG 202,65 6291655 75230 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 661r REG 202,65 6292826 75231 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 662r REG 202,65 6291567 75233 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 663r REG 202,65 6293259 75226 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 664r REG 202,65 6291836 75234 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 665r REG 202,65 6291475 75235 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 666r REG 202,65 6291463 75238 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 667r REG 202,65 6291550 75237 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 668r REG 202,65 6291469 75232 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 669r REG 202,65 6291488 75239 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 670r REG 202,65 6291798 75240 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 671r REG 202,65 6291462 75242 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 672r REG 202,65 6292889 75243 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 673r REG 202,65 6291580 75244 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 674r REG 202,65 6291467 75236 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 675r REG 202,65 6291768 75245 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 676r REG 202,65 6291673 75248 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 677r REG 202,65 6292831 75249 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 678r REG 202,65 6291658 75256 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 679r REG 202,65 6291543 75241 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 680r REG 202,65 6291456 75250 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 681r REG 202,65 6291462 75251 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 682r REG 202,65 6291537 75254 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 683r REG 202,65 6291742 75253 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 684r REG 202,65 6291619 75255 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 685r REG 202,65 6291459 75262 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 686r REG 202,65 6293513 75247 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 687r REG 202,65 6291474 75258 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 688r REG 202,65 6291461 75259 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 689r REG 202,65 6291485 75260 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 690r REG 202,65 6291591 75266 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 691r REG 202,65 6291552 75261 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 692r REG 202,65 6292721 75252 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 693r REG 202,65 6291583 75283 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 694r REG 202,65 6291546 75264 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 695r REG 202,65 6291570 75265 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 696r REG 202,65 6291834 75269 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 697r REG 202,65 6291955 75257 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 698r REG 202,65 6291766 75267 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 699r REG 202,65 6291847 75270 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 700r REG 202,65 6291464 75271 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 701r REG 202,65 6292682 75275 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 702r REG 202,65 6291536 75263 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 703r REG 202,65 6291462 75272 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 704r REG 202,65 6291652 75277 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 705r REG 202,65 6291636 75281 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 706r REG 202,65 6293419 75278 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 707r REG 202,65 6291507 75268 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 708r REG 202,65 6291749 75279 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 709r REG 202,65 6291705 75282 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 710r REG 202,65 6292442 75292 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 711r REG 202,65 6291461 75284 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 712r REG 202,65 6291544 75285 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 713r REG 202,65 6291573 75274 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 714r REG 202,65 6293039 75288 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 715r REG 202,65 6291655 75287 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 716r REG 202,65 6291482 75289 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 717r REG 202,65 6291712 75280 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 718r REG 202,65 6291749 75303 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 719r REG 202,65 6291575 75290 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 720r REG 202,65 6291459 75293 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 721r REG 202,65 6291793 75294 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 722r REG 202,65 6291501 75295 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 723r REG 202,65 6291546 75286 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 724r REG 202,65 6291489 75296 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 725r REG 202,65 6292103 75299 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 726r REG 202,65 6291515 75300 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 727r REG 202,65 6292564 75291 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 728r REG 202,65 6291643 75301 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 729r REG 202,65 6291474 75302 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 730r REG 202,65 6291459 75305 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 731r REG 202,65 6291477 75304 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 732r REG 202,65 6291556 75306 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 733r REG 202,65 6293008 75307 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 734r REG 202,65 6291468 75297 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 735r REG 202,65 6291536 75309 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 736r REG 202,65 6291556 75317 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 737r REG 202,65 6291519 75310 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 738r REG 202,65 6291683 75311 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 739r REG 202,65 6291546 75312 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 740r REG 202,65 6294055 75314 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 741r REG 202,65 6291767 75316 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 742r REG 202,65 6291537 75315 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 743r REG 202,65 6293701 75313 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 744r REG 202,65 6291474 75308 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 745r REG 202,65 6291533 75318 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 746r REG 202,65 6291683 75321 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 747r REG 202,65 6291479 75323 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 748r REG 202,65 6291727 75331 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 749r REG 202,65 6291563 75325 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 750r REG 202,65 6291733 75327 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 751r REG 202,65 6291567 75329 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 752r REG 202,65 6292166 75330 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 753r REG 202,65 6292201 75336 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 754r REG 202,65 6291533 75320 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 755r REG 202,65 6293130 75332 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 756r REG 202,65 6291553 75334 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 757r REG 202,65 6291530 75339 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 758r REG 202,65 6291782 75335 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 759r REG 202,65 6292389 75337 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 760r REG 202,65 6292527 75338 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 761r REG 202,65 6291467 75328 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 762r REG 202,65 6291763 75340 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 763r REG 202,65 6291722 75341 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 764r REG 202,65 6291647 75333 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 765r REG 202,65 6292287 75342 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 766r REG 202,65 6292722 75363 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 767r REG 202,65 6292975 75343 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 768r REG 202,65 6291496 75364 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 769r REG 202,65 6293598 75365 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 770r REG 202,65 6291517 75374 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 771r REG 202,65 6291636 75367 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 772r REG 202,65 6291481 75369 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 774r REG 202,65 6291587 75371 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 776r REG 202,65 6291687 75372 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 777r REG 202,65 6291609 75370 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 778r REG 202,65 6291555 75362 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 779r REG 202,65 6291548 75373 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 780r REG 202,65 6291541 75375 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 781r REG 202,65 6291606 75376 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 782r REG 202,65 6291772 75414 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 783r REG 202,65 6291555 75377 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 784r REG 202,65 6291725 75368 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 785r REG 202,65 6293625 75380 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 786r REG 202,65 6291514 75381 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 787r REG 202,65 6291583 75382 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 788r REG 202,65 6291745 75384 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 789r REG 202,65 6291485 75385 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 790r REG 202,65 6291470 75395 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 791r REG 202,65 6292589 75378 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 792r REG 202,65 6291753 75379 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 793r REG 202,65 6291949 75398 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 794r REG 202,65 6291527 75400 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 795r REG 202,65 6292398 75399 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 796r REG 202,65 6291483 75402 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 797r REG 202,65 6291617 75401 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 798r REG 202,65 6291589 75411 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 799r REG 202,65 6291492 75413 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 800r REG 202,65 6291673 75412 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 801r REG 202,65 6291552 75493 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 802r REG 202,65 6291607 75418 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 803r REG 202,65 6293506 75396 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 804r REG 202,65 6292109 75397 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 805r REG 202,65 6291474 75417 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 806r REG 202,65 6291584 75448 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 808r REG 202,65 6291563 75452 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 809r REG 202,65 6291494 75447 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 810r REG 202,65 6292644 75453 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 811r REG 202,65 6291646 75457 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 812r REG 202,65 6291494 75454 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 813r REG 202,65 6291498 75455 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 814r REG 202,65 6291483 75415 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 815r REG 202,65 6291763 75416 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 816r REG 202,65 6291531 75470 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 817r REG 202,65 6291512 75458 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 818r REG 202,65 6291499 75459 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 819r REG 202,65 6292667 75468 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 820r REG 202,65 6292717 75469 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 821r REG 202,65 6291478 75471 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 822r REG 202,65 6291596 75472 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 823r REG 202,65 6291584 75473 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 824r REG 202,65 6291596 75456 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 825r REG 202,65 6291626 75474 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 826r REG 202,65 6291562 75475 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 827r REG 202,65 6291529 75494 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 828r REG 202,65 6291503 75495 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 829r REG 202,65 6291462 75496 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 830r REG 202,65 6291590 75498 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 831r REG 202,65 6291492 75497 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 832r REG 202,65 6291660 75499 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 833r REG 202,65 6291516 75500 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 834r REG 202,65 6291474 75510 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 835r REG 202,65 6291468 75478 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 836r REG 202,65 6291566 75503 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 837r REG 202,65 6291580 75504 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 838r REG 202,65 6291587 75507 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 839r REG 202,65 6291597 75505 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 840r REG 202,65 6291574 75506 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 841r REG 202,65 6291708 75509 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 842r REG 202,65 6291599 75508 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 843r REG 202,65 6292450 75519 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 844r REG 202,65 6291464 75511 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 845r REG 202,65 6291634 75515 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 846r REG 202,65 6293238 75501 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 847r REG 202,65 6291513 75502 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 848r REG 202,65 6291544 75513 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 849r REG 202,65 6291499 75517 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 850r REG 202,65 6292926 75516 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 851r REG 202,65 6291564 75518 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 852r REG 202,65 6291568 75522 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 853r REG 202,65 6291534 75520 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 854r REG 202,65 6292225 75534 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 855r REG 202,65 6291490 75523 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 856r REG 202,65 6292145 75512 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 857r REG 202,65 6291618 75535 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 858r REG 202,65 6291532 75524 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 859r REG 202,65 6291672 75545 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 860r REG 202,65 6291503 75546 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 861r REG 202,65 6291683 75547 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 862r REG 202,65 6291565 75548 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 863r REG 202,65 6291553 75550 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 864r REG 202,65 6291502 75549 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 865r REG 202,65 6291535 75588 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 866r REG 202,65 6291615 75551 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 867r REG 202,65 6291503 75555 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 868r REG 202,65 6291516 75552 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 869r REG 202,65 6291545 75554 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 870r REG 202,65 6291716 75556 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 871r REG 202,65 6291632 75557 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 872r REG 202,65 6291528 75558 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 873r REG 202,65 6291463 75585 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 874r REG 202,65 6291601 75586 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 875r REG 202,65 6291754 75587 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 876r REG 202,65 6291741 75594 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 877r REG 202,65 6292017 75553 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 878r REG 202,65 6291533 75589 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 879r REG 202,65 6291669 75591 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 880r REG 202,65 6291466 75608 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 881r REG 202,65 6291845 75592 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 882r REG 202,65 6291602 75593 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 883r REG 202,65 6293283 75595 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 884r REG 202,65 6291459 75596 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 885r REG 202,65 6292380 75597 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 886r REG 202,65 6291524 75598 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 887r REG 202,65 6291564 75599 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 888r REG 202,65 6291499 75590 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 889r REG 202,65 6291531 75600 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 890r REG 202,65 6291514 75603 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 891r REG 202,65 6291472 75602 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 892r REG 202,65 6291627 75604 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 893r REG 202,65 6291457 75605 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 894r REG 202,65 6291575 75607 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 895r REG 202,65 6291574 75606 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 896r REG 202,65 6291552 75634 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 897r REG 202,65 6291539 75609 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 898r REG 202,65 6291585 75601 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 899r REG 202,65 6291545 75612 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 900r REG 202,65 6291520 75610 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 901r REG 202,65 6291457 75615 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 902r REG 202,65 6291537 75613 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 903r REG 202,65 6291490 75614 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 904r REG 202,65 6291472 75617 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 905r REG 202,65 6291477 75616 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 906r REG 202,65 6291539 75628 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 907r REG 202,65 6291483 75618 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 908r REG 202,65 6291528 75619 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 909r REG 202,65 6291568 75627 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 910r REG 202,65 6291547 75611 /var/log/audit/audit.log.4 (deleted) filebeat 1852 root 912r REG 202,65 6291678 75630 /var/log/audit/audit.log.4 (deleted) java 14121 tnuser 93r REG 202,161 1090 655847 /data/03/cassandra/data/user_group_store/sg_friends/user_group_store-sg_friends-jb-2-Data.db (deleted) java 14121 tnuser 142r REG 202,161 233 655846 /data/03/cassandra/data/user_group_store/sg_friends/user_group_store-sg_friends-jb-2-Index.db (deleted)
4. 根据lsof列出的进程号，kill这些进程,稍等片刻,再查看磁盘容量使用情况,注意如果不熟悉进程的作用,请不要随意kill
# kill -9 1852 # df -h Filesystem Size Used Avail Use% Mounted on /dev/xvde1 9.9G 3.3G 6.1G 36% / none 7.4G 16K 7.4G 1% /dev/shm
原理:
在linux上被删除的文件仍被其他进程所使用，文件句柄没有完全释放出来，导致空间无法释放出来,在Linux或者Unix系统中，通过rm或者文件管理器删除文件将会从文件系统的目录结构上解除链接(unlink).然而如果文件是被打开的（有一个进程正在使用），那么进程将仍然可以读取该文件，磁盘空间也一直被占用。
解决：
一、通过lsof |grep deleted查看被占用文件
二、释放被占用文件磁盘空间
- kill掉相应的进程
- 停掉使用这个文件的应用，让os自动回收磁盘空间
===================来自一泽涟漪的博客,转载请标明出处 www.cnblogs.com/ilifeilong===================
