Odd things in messages: 10:19:41 ns1 php-fpm: [24-Mar-2019 10:19:41] ERROR: [pool www] cannot get uid for user 'www-data' Mar 24 10:19:41 ns1 php-fpm: [24-Mar-2019 10:19:41] ERROR: FPM initialization failed Mar 24 10:19:41 ns1 systemd: php72-fpm.service: main process exited, code=exited, status=78/n/a Mar 24 10:19:41 ns1 systemd: Unit php72-fpm.service entered failed state. Mar 24 10:19:41 ns1 systemd: php72-fpm.service failed. Mar 24 10:19:42 ns1 php-fpm: [24-Mar-2019 10:19:42] WARNING: Nothing matches the include pattern '/opt/php56/etc/php-fpm.d/*.conf' from /opt/php56/etc/php-fpm.conf at line 544. Mar 24 10:19:42 ns1 php-fpm: [24-Mar-2019 10:19:42] ERROR: [pool www] cannot get uid for user 'www-data' Mar 24 10:19:42 ns1 php-fpm: [24-Mar-2019 10:19:42] ERROR: FPM initialization failed Mar 24 10:19:42 ns1 systemd: php56-fpm.service: main process exited, code=exited, status=78/n/a Mar 24 10:19:42 ns1 systemd: Unit php56-fpm.service entered failed state. Mar 24 10:19:42 ns1 systemd: php56-fpm.service failed. this only just started! www-data is indeed the user specified in the conf file. but what has changed? also - I'm seeing these messages on one server but not the other - why is dracut trying to run? no obvious signs of hacking - but its not on my other server! Mar 24 09:58:33 ns1 dracut: dracut module 'modsign' will not be installed, because command 'keyctl' could not be found! Mar 24 09:58:33 ns1 dracut: dracut module 'busybox' will not be installed, because command 'busybox' could not be found! Mar 24 09:58:33 ns1 dracut: dracut module 'ifcfg' will not be installed, because it's in the list to be omitted! Mar 24 09:58:33 ns1 dracut: dracut module 'plymouth' will not be installed, because it's in the list to be omitted! Mar 24 09:58:34 ns1 dracut: dracut module 'crypt' will not be installed, because command 'cryptsetup' could not be found! Mar 24 09:58:34 ns1 dracut: dracut module 'dmraid' will not be installed, because command 'dmraid' could not be found! Mar 24 09:58:34 ns1 httpd: AH00548: NameVirtualHost has no effect and will be removed in the next release /etc/httpd/conf/httpd.conf:356 Mar 24 09:58:34 ns1 dracut: dracut module 'dmsquash-live-ntfs' will not be installed, because command 'ntfs-3g' could not be found! Mar 24 09:58:34 ns1 dracut: dracut module 'mdraid' will not be installed, because command 'mdadm' could not be found! Mar 24 09:58:34 ns1 smbd[9581]: [2019/03/24 09:58:34.350615, 0] ../lib/util/become_daemon.c:138(daemon_ready) Mar 24 09:58:34 ns1 smbd[9581]: daemon_ready: STATUS=daemon 'smbd' finished starting up and ready to serve connections Mar 24 09:58:34 ns1 dracut: dracut module 'multipath' will not be installed, because command 'multipath' could not be found! Mar 24 09:58:34 ns1 chronyd[7470]: Selected source 47.190.36.230 Mar 24 09:58:34 ns1 dracut: dracut module 'cifs' will not be installed, because command 'mount.cifs' could not be found! Mar 24 09:58:34 ns1 dracut: dracut module 'iscsi' will not be installed, because command 'iscsistart' could not be found! Mar 24 09:58:34 ns1 dracut: dracut module 'iscsi' will not be installed, because command 'iscsi-iname' could not be found! Mar 24 09:58:34 ns1 dracut: 95nfs: Could not find any command of 'rpcbind portmap'! Mar 24 09:58:34 ns1 dracut: dracut module 'resume' will not be installed, because it's in the list to be omitted! Mar 24 09:58:35 ns1 dracut: dracut module 'modsign' will not be installed, because command 'keyctl' could not be foun should I be concerned? These only started TODAY - dracut not mentioned in any prior logs.
yes as far as I can tell no sign of intrusion. rhkunter etc and ispprotect both running. no odd root logins would something else have installed dracut??
Try to find out what operating system you are running. Most likely it keeps a log of package installations, so you can see when dracut appeared.
