Linux – What does “Still Running” mean (Linux)

I venture to suggest a solution: try adding

  Before=basic.target

to /usr/lib/systemd/system/dbus.service.

I am struck by an oddity, in your logs, that reminds me of an accident I have read about some time ago, in the Arch Linux forums: this system would hang on reboot. The solution was offered as above, on the ground that the hang would be caused by some service trying to talk to d-bus after it was halted:

So by ordering it before the basic.target it not only starts before the basic target is reached, but also ensures that it stays around until after the basic.target is brought down during shutdown.

In your unhealthy log, we see in fact that the Basic System is not stopped, while it is properly stopped in the healthy log.

Should this not work, and considering that you cannot upgrade, have you considered a downgrade?

You can begin by search if the user nagent is owner of files on your system:

find / -user nagent -iname "*" -exec ls -l {} \;

And you can look at if some process have been launched and not again stopped by this user:

ps -ef | grep nagent

In yours logs, you can look at the activity of your server around the 27 october 21:10, something like this:

cat /var/log/<your file> | grep "Oct 27 21:1"

EDIT 1: Some files has been modified/created during the same time of the userdel and useradd:

-rw-r--r--. 1 root root  615 Oct 27 21:11 nagent.conf
-rw-r--r--. 1 root root  615 Oct 27 21:11 nagent.conf.Save
-rwxr-xr-x. 1 root root 5510 Oct 27 21:11 nagent_download.sh
-rwxr-xr-x. 1 root root 1665 Oct 27 21:11 uninstall.sh

Can you read nagent.conf and nagent_download.sh ?

EDIT 2: Can you verify if you have a process which listen on the TCP port 80:

 netstat -antp | grep 80

Have you done a update/upgrade maybe the 27 oct 21h ?

EDIT 3:

From the netstat command, you have the port 80 opened by a process with PID of 2027:java. Moreover, this process opens the 8089 and the 443 which has a connection with a machine :

  ::ffff:192.168.1.18:443     ::ffff:70.192.192.180:10757 ESTABLISHED     2027/java

To have more infos, you can do ps -ef | grep 2027 and see details on the commands and the parent process of it.

From your ps command, you have a service named nagent in /etc/init.d/nagent

In conclusion, you or someone have installed the agent of the N-central software (the files and process match with the doc done by @ojs in his solution). Now, you must search who and how this software has been installed.

To know which package has been installed: ls -ltr /var/lib/dpkg/info/*.list

You can look the .bash_history in the home directory of the users of your server