# captured_at=2026-07-23T11:45:59+08:00
# command=ps -eo pid\,ppid\,user\,group\,lstart\,cmd 
    PID    PPID USER     GROUP                     STARTED CMD
      1       0 root     root     Tue Jul 21 11:06:33 2026 /usr/lib/systemd/systemd --switched-root --system --deserialize=35 rhgb
      2       0 root     root     Tue Jul 21 11:06:33 2026 [kthreadd]
      3       2 root     root     Tue Jul 21 11:06:33 2026 [pool_workqueue_release]
      4       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-rcu_g]
      5       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-rcu_p]
      6       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-slub_]
      7       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-netns]
      9       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/0:0H-events_highpri]
     11       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/u8:0-ext4-rsv-conversion]
     12       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-mm_pe]
     13       2 root     root     Tue Jul 21 11:06:33 2026 [rcu_tasks_rude_kthread]
     14       2 root     root     Tue Jul 21 11:06:33 2026 [rcu_tasks_trace_kthread]
     15       2 root     root     Tue Jul 21 11:06:33 2026 [ksoftirqd/0]
     16       2 root     root     Tue Jul 21 11:06:33 2026 [rcu_sched]
     17       2 root     root     Tue Jul 21 11:06:33 2026 [migration/0]
     18       2 root     root     Tue Jul 21 11:06:33 2026 [idle_inject/0]
     19       2 root     root     Tue Jul 21 11:06:33 2026 [cpuhp/0]
     20       2 root     root     Tue Jul 21 11:06:33 2026 [cpuhp/1]
     21       2 root     root     Tue Jul 21 11:06:33 2026 [idle_inject/1]
     22       2 root     root     Tue Jul 21 11:06:33 2026 [migration/1]
     23       2 root     root     Tue Jul 21 11:06:33 2026 [ksoftirqd/1]
     25       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/1:0H-kblockd]
     26       2 root     root     Tue Jul 21 11:06:33 2026 [cpuhp/2]
     27       2 root     root     Tue Jul 21 11:06:33 2026 [idle_inject/2]
     28       2 root     root     Tue Jul 21 11:06:33 2026 [migration/2]
     29       2 root     root     Tue Jul 21 11:06:33 2026 [ksoftirqd/2]
     31       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/2:0H-events_highpri]
     32       2 root     root     Tue Jul 21 11:06:33 2026 [cpuhp/3]
     33       2 root     root     Tue Jul 21 11:06:33 2026 [idle_inject/3]
     34       2 root     root     Tue Jul 21 11:06:33 2026 [migration/3]
     35       2 root     root     Tue Jul 21 11:06:33 2026 [ksoftirqd/3]
     37       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/3:0H-events_highpri]
     39       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/u10:0-events_unbound]
     41       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/u12:0-events_unbound]
     43       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/u11:1-writeback]
     45       2 root     root     Tue Jul 21 11:06:33 2026 [kdevtmpfs]
     46       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-inet_]
     47       2 root     root     Tue Jul 21 11:06:33 2026 [kauditd]
     49       2 root     root     Tue Jul 21 11:06:33 2026 [khungtaskd]
     50       2 root     root     Tue Jul 21 11:06:33 2026 [oom_reaper]
     51       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/u10:1-events_unbound]
     52       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-write]
     54       2 root     root     Tue Jul 21 11:06:33 2026 [kcompactd0]
     55       2 root     root     Tue Jul 21 11:06:33 2026 [ksmd]
     56       2 root     root     Tue Jul 21 11:06:33 2026 [khugepaged]
     57       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-crypt]
     58       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-kinte]
     59       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-kbloc]
     60       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-blkcg]
     62       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-tpm_d]
     63       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-md]
     64       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-md_bi]
     65       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-edac-]
     66       2 root     root     Tue Jul 21 11:06:33 2026 [watchdogd]
     69       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/0:1H-kblockd]
     70       2 root     root     Tue Jul 21 11:06:33 2026 [kswapd0]
     72       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-kthro]
     76       2 root     root     Tue Jul 21 11:06:33 2026 [irq/24-pciehp]
     77       2 root     root     Tue Jul 21 11:06:33 2026 [irq/25-pciehp]
     78       2 root     root     Tue Jul 21 11:06:33 2026 [irq/26-pciehp]
     79       2 root     root     Tue Jul 21 11:06:33 2026 [irq/27-pciehp]
     80       2 root     root     Tue Jul 21 11:06:33 2026 [irq/28-pciehp]
     81       2 root     root     Tue Jul 21 11:06:33 2026 [irq/29-pciehp]
     82       2 root     root     Tue Jul 21 11:06:33 2026 [irq/30-pciehp]
     83       2 root     root     Tue Jul 21 11:06:33 2026 [irq/31-pciehp]
     84       2 root     root     Tue Jul 21 11:06:33 2026 [irq/32-pciehp]
     85       2 root     root     Tue Jul 21 11:06:33 2026 [irq/33-pciehp]
     86       2 root     root     Tue Jul 21 11:06:33 2026 [irq/34-pciehp]
     87       2 root     root     Tue Jul 21 11:06:33 2026 [irq/35-pciehp]
     88       2 root     root     Tue Jul 21 11:06:33 2026 [irq/36-pciehp]
     89       2 root     root     Tue Jul 21 11:06:33 2026 [irq/37-pciehp]
     90       2 root     root     Tue Jul 21 11:06:33 2026 [irq/38-pciehp]
     91       2 root     root     Tue Jul 21 11:06:33 2026 [irq/39-pciehp]
     92       2 root     root     Tue Jul 21 11:06:33 2026 [irq/40-pciehp]
     93       2 root     root     Tue Jul 21 11:06:33 2026 [irq/41-pciehp]
     94       2 root     root     Tue Jul 21 11:06:33 2026 [irq/42-pciehp]
     95       2 root     root     Tue Jul 21 11:06:33 2026 [irq/43-pciehp]
     96       2 root     root     Tue Jul 21 11:06:33 2026 [irq/44-pciehp]
     97       2 root     root     Tue Jul 21 11:06:33 2026 [irq/45-pciehp]
     98       2 root     root     Tue Jul 21 11:06:33 2026 [irq/46-pciehp]
     99       2 root     root     Tue Jul 21 11:06:33 2026 [irq/47-pciehp]
    100       2 root     root     Tue Jul 21 11:06:33 2026 [irq/48-pciehp]
    101       2 root     root     Tue Jul 21 11:06:33 2026 [irq/49-pciehp]
    102       2 root     root     Tue Jul 21 11:06:33 2026 [irq/50-pciehp]
    103       2 root     root     Tue Jul 21 11:06:33 2026 [irq/51-pciehp]
    104       2 root     root     Tue Jul 21 11:06:33 2026 [irq/52-pciehp]
    105       2 root     root     Tue Jul 21 11:06:33 2026 [irq/53-pciehp]
    106       2 root     root     Tue Jul 21 11:06:33 2026 [irq/54-pciehp]
    107       2 root     root     Tue Jul 21 11:06:33 2026 [irq/55-pciehp]
    108       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-acpi_]
    109       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/u9:2-writeback]
    110       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-kmpat]
    111       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-kalua]
    113       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-mld]
    114       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-ipv6_]
    115       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/R-kstrp]
    226       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/u13:0]
    227       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/u14:0]
    228       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/u15:0]
    229       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/u16:0]
    230       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/u17:0]
    231       2 root     root     Tue Jul 21 11:06:33 2026 [kworker/3:1H-kblockd]
    279       2 root     root     Tue Jul 21 11:06:34 2026 [kworker/2:1H-kblockd]
    293       2 root     root     Tue Jul 21 11:06:34 2026 [kworker/R-kmpat]
    294       2 root     root     Tue Jul 21 11:06:34 2026 [kworker/R-kmpat]
    452       2 root     root     Tue Jul 21 11:06:34 2026 [kworker/1:3-events]
    506       2 root     root     Tue Jul 21 11:06:35 2026 [kworker/R-ata_s]
    507       2 root     root     Tue Jul 21 11:06:35 2026 [scsi_eh_0]
    508       2 root     root     Tue Jul 21 11:06:35 2026 [kworker/R-scsi_]
    509       2 root     root     Tue Jul 21 11:06:36 2026 [scsi_eh_1]
    510       2 root     root     Tue Jul 21 11:06:36 2026 [kworker/R-scsi_]
    525       2 root     root     Tue Jul 21 11:06:36 2026 [scsi_eh_2]
    526       2 root     root     Tue Jul 21 11:06:36 2026 [kworker/R-scsi_]
    527       2 root     root     Tue Jul 21 11:06:36 2026 [kworker/R-vmw_p]
    541       2 root     root     Tue Jul 21 11:06:36 2026 [irq/16-vmwgfx]
    542       2 root     root     Tue Jul 21 11:06:36 2026 [kworker/R-ttm]
    549       2 root     root     Tue Jul 21 11:06:36 2026 [kworker/0:3-cgroup_destroy]
    618       2 root     root     Tue Jul 21 11:06:37 2026 [kworker/R-kdmfl]
    625       2 root     root     Tue Jul 21 11:06:37 2026 [kworker/R-kdmfl]
    649       2 root     root     Tue Jul 21 11:06:38 2026 [jbd2/dm-0-8]
    650       2 root     root     Tue Jul 21 11:06:38 2026 [kworker/R-ext4-]
    734       1 root     root     Tue Jul 21 11:06:39 2026 /usr/lib/systemd/systemd-journald
    777       2 root     root     Tue Jul 21 11:06:39 2026 [kworker/u8:1-ext4-rsv-conversion]
    792       1 root     root     Tue Jul 21 11:06:39 2026 /usr/lib/systemd/systemd-udevd
    838       2 root     root     Tue Jul 21 11:06:39 2026 [kworker/1:2H-kblockd]
    839       2 root     root     Tue Jul 21 11:06:39 2026 [irq/62-vmw_vmci]
    842       2 root     root     Tue Jul 21 11:06:39 2026 [irq/63-vmw_vmci]
    925       2 root     root     Tue Jul 21 11:06:40 2026 [jbd2/sda2-8]
    928       2 root     root     Tue Jul 21 11:06:40 2026 [kworker/R-ext4-]
    949       2 root     root     Tue Jul 21 11:06:40 2026 [kworker/R-nfit]
    966       1 rpc      rpc      Tue Jul 21 11:06:40 2026 /usr/bin/rpcbind -r -w -f
    967       1 root     root     Tue Jul 21 11:06:40 2026 /sbin/auditd
    990       1 dbus     dbus     Tue Jul 21 11:06:40 2026 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
    994       1 libstor+ libstor+ Tue Jul 21 11:06:40 2026 /usr/bin/lsmd -d
    995       1 root     root     Tue Jul 21 11:06:40 2026 /opt/prometheus/node_exporter/node_exporter
    999       1 root     root     Tue Jul 21 11:06:40 2026 /usr/sbin/rngd -f -O jitter:timeout:10
   1001       1 root     root     Tue Jul 21 11:06:40 2026 /usr/lib/systemd/systemd-logind
   1003       1 root     root     Tue Jul 21 11:06:40 2026 /usr/sbin/irqbalance --hintpolicy=subset --pid=/var/run/irqbalance.pid
   1027       1 root     root     Tue Jul 21 11:06:40 2026 /usr/sbin/restorecond
   1034       1 chrony   chrony   Tue Jul 21 11:06:40 2026 /usr/sbin/chronyd
   1042       1 root     root     Tue Jul 21 11:06:40 2026 /usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid
   1132       1 root     root     Tue Jul 21 11:06:42 2026 /usr/sbin/NetworkManager --no-daemon
   1157       1 root     root     Tue Jul 21 11:06:42 2026 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
   1163       1 root     root     Tue Jul 21 11:06:42 2026 /usr/bin/python3 -Es /usr/sbin/tuned -l -P
   1170       1 root     root     Tue Jul 21 11:06:42 2026 /usr/sbin/atd -f
   1174       1 root     root     Tue Jul 21 11:06:42 2026 /usr/sbin/crond -n
   1191       1 root     root     Tue Jul 21 11:06:42 2026 /sbin/agetty -o -p -- \u --noclear - linux
   1299       1 polkitd  polkitd  Tue Jul 21 11:06:43 2026 /usr/lib/polkit-1/polkitd --no-debug
   1448       1 root     root     Tue Jul 21 11:06:44 2026 /usr/sbin/rsyslogd -n -i/var/run/rsyslogd.pid
  10296       1 root     root     Tue Jul 21 11:07:48 2026 /usr/sbin/vmtoolsd
  10321       1 root     root     Tue Jul 21 11:07:48 2026 /usr/lib/vmware-vgauth/VGAuthService -s
  11336       2 root     root     Tue Jul 21 15:47:17 2026 [kworker/3:3-events]
  12502       2 root     root     Wed Jul 22 06:56:51 2026 [kworker/u12:2-events_unbound]
  14125    1157 root     root     Wed Jul 22 20:54:45 2026 sshd: root [priv]
  14129   14125 root     root     Wed Jul 22 20:54:45 2026 sshd: root@pts/1
  14130    1157 root     root     Wed Jul 22 20:54:45 2026 sshd: root [priv]
  14134   14130 root     root     Wed Jul 22 20:54:45 2026 sshd: root@notty
  14135   14134 root     root     Wed Jul 22 20:54:45 2026 /usr/libexec/openssh/sftp-server -l INFO -f AUTH
  14189   14129 root     root     Wed Jul 22 20:54:45 2026 -bash
  14479       2 root     root     Wed Jul 22 21:07:56 2026 [kworker/0:0-events]
  14545    1157 root     root     Wed Jul 22 21:19:18 2026 sshd: root [priv]
  14549   14545 root     root     Wed Jul 22 21:19:19 2026 sshd: root@pts/0
  14550    1157 root     root     Wed Jul 22 21:19:19 2026 sshd: root [priv]
  14554   14550 root     root     Wed Jul 22 21:19:19 2026 sshd: root@notty
  14555   14554 root     root     Wed Jul 22 21:19:19 2026 /usr/libexec/openssh/sftp-server -l INFO -f AUTH
  14609   14549 root     root     Wed Jul 22 21:19:19 2026 -bash
  14707       2 root     root     Wed Jul 22 21:29:54 2026 [kworker/u9:0-events_unbound]
  14747    1157 root     root     Wed Jul 22 21:34:02 2026 sshd: root [priv]
  14751   14747 root     root     Wed Jul 22 21:34:02 2026 sshd: root@pts/2
  14752    1157 root     root     Wed Jul 22 21:34:02 2026 sshd: root [priv]
  14756   14752 root     root     Wed Jul 22 21:34:02 2026 sshd: root@notty
  14757   14756 root     root     Wed Jul 22 21:34:02 2026 /usr/libexec/openssh/sftp-server -l INFO -f AUTH
  14811   14751 root     root     Wed Jul 22 21:34:03 2026 -bash
  14887       2 root     root     Wed Jul 22 21:34:33 2026 [kworker/1:0-cgroup_destroy]
  15310       2 root     root     Thu Jul 23 03:01:06 2026 [kworker/u11:2-events_unbound]
  15490       2 root     root     Thu Jul 23 05:58:34 2026 [kworker/2:1-cgroup_destroy]
  16143       2 root     root     Thu Jul 23 09:57:10 2026 [kworker/2:2-events]
  19290       2 root     root     Thu Jul 23 11:38:06 2026 [kworker/3:0-ata_sff]
  19291       2 root     root     Thu Jul 23 11:43:33 2026 [kworker/3:1-ata_sff]
  19301   14609 root     root     Thu Jul 23 11:45:58 2026 bash /root/q041-preinstall-check.sh q041-20260723T114537+0800
  19311   19301 root     root     Thu Jul 23 11:45:58 2026 tee -a /var/backups/zhct-q041/evidence/q041-20260723T114537+0800/preinstall-check.log
  19356   19301 root     root     Thu Jul 23 11:45:59 2026 ps -eo pid,ppid,user,group,lstart,cmd
