nmap security scan cause DDLProc restarted

Customer reported DDLProc restarting without any workload. Further investigation and customer's internal test has proved that it was due to service discovery via nmap.

• DDLProc restart:

Jun 7 17:10:00 host1 ProcessMonitor[17456]: 00.515314 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 1975

Jun 7 17:11:00 host1 ProcessMonitor[17456]: 00.512870 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 14737

Jun 7 17:12:00 host1 ProcessMonitor[17456]: 00.511107 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 18114

Jun 7 17:12:50 host1 ProcessMonitor[17456]: 50.421923 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 19776

Jun 7 17:13:00 host1 ProcessMonitor[17456]: 00.514229 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 21232

Jun 7 17:14:00 host1 ProcessMonitor[17456]: 00.515231 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 21484

Jun 7 17:15:00 host1 ProcessMonitor[17456]: 00.512192 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 23080

Jun 7 17:16:00 host1 ProcessMonitor[17456]: 00.516688 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 25084

Jun 7 17:17:00 host1 ProcessMonitor[17456]: 00.514691 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 28107

Jun 7 17:18:00 host1 ProcessMonitor[17456]: 00.515758 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 29559

Jun 7 17:19:00 host1 ProcessMonitor[17456]: 00.512694 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 31345

Jun 7 17:20:00 host1 ProcessMonitor[17456]: 00.510610 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 478

• /var/log/messages:

  Jun 7 17:12:10 host1 ssh-server-g3: 114 Servant_warning, "Failed to resolve remote hostname.", Session-Id: 148485

  Jun 7 17:12:10 host1 ssh-server-g3: 400 Connect, Src IP: <ip>, Dst IFace: cyber-ark, Dst IP: <ip>, Src Port: 60022, Dst Port: 63022, Ver: SSH-2.0-Rapid7SSH_0.2, Session-Id: 148485

  Jun 7 17:12:10 host1 ssh-server-g3: 1002 Algorithm_negotiation_success, "kex_algorithm=diffie-hellman-group-exchange-sha1, hostkey_algorithm=ssh-rsa, cipher=aes128-cbc/aes128-cbc, mac=hmac-sha1/hmac-sha1, compression=none/none", Session-Id: 148485

  Jun 7 17:12:10 host1 ssh-server-g3: 1003 KEX_success, Algorithm: diffie-hellman-group-exchange-sha1, Modulus: 2048 bits, Session-Id: 148485, Protocol-session-Id: 7DF08752DA455FC9A6F919F90CEA2C3178769B9F

  Jun 7 17:12:10 host1 ssh-server-g3: 411 Login_failure, Username: , Reason: Connection lost, Src IP: <ip>, Dst IFace: cyber-ark, Dst IP: <ip>, Src Port: 60022, Dst Port: 63022, "Connection lost, Local Disconnect", Session-Id: 148485

  Jun 7 17:12:10 host1 ssh-server-g3: 402 Disconnect, Reason: Connection lost, Src IP: <ip>, Dst IFace: cyber-ark, Dst IP: <ip>, Src Port: 60022, Dst Port: 63022, "Connection lost, Local Disconnect", Session-Id: 148485

  Jun 7 17:12:10 host1 ssh-server-g3: 403 Version_exchange_failure, Error: Protocol error, Src IP: <ip>, Dst IFace: cyber-ark, Dst IP: <ip>, Src Port: 45720, Dst Port: 63022, "Version exchange failed: Malformed client version string prefix: ", Session-Id: 148483

  Jun 7 17:12:10 host1 ssh-server-g3: 402 Disconnect, Reason: , Src IP: <ip>, Dst IFace: cyber-ark, Dst IP: <ip>, Src Port: 45720, Dst Port: 63022, "Version exchange failed, Remote Disconnect", Session-Id: 148483

  Jun 7 17:12:50 host1 ProcessMonitor[17456]: 50.421923 |0|0|0| C 18 CAL0000: *****MariaDB ColumnStore Process Restarting: DDLProc, old PID = 19776

  Jun 7 17:12:54 host1 ProcessMonitor[17456]: 54.504540 |0|0|0| I 18 CAL0000: MariaDB ColumnStore Process DDLProc restarted successfully!!