I am wondering why OSSEC would be reporting hidden processes on my ovirt nodes? I run OSSEC across the infrastructure and multiple ovirt clusters have assorted nodes that will report a process is running but does not have an entry in /proc and thus "possible rootkit" alert is fired

I am well aware that I do not have rootkits on these systems but am wondering what exactly inside ovirt is causing this to trigger? Or any ideas? Below is sample alert. All my google-fu turns up is that a process would have to **try** to hide itself from /proc, so curious what this is inside ovirt. Thanks!

-------------