Attachment 146337 Details for Bug 224028 – audit.log from ricci (cluster) node

audit.log from ricci (cluster) node

audit.log (text/plain), 55.58 KB, created by Len DiMaggio on 2007-01-23 19:00:40 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Len DiMaggio

Created: 2007-01-23 19:00:40 UTC

Size: 55.58 KB

patch

obsolete

>type=DAEMON_START msg=audit(1169500495.206:8795) auditd start, ver=1.3.1, format=raw, auid=4294967295 pid=1542 res=success, auditd pid=1542
>type=CONFIG_CHANGE msg=audit(1169500495.305:4): audit_enabled=1 old=0 by auid=4294967295
>type=CONFIG_CHANGE msg=audit(1169500495.368:5): audit_backlog_limit=256 old=64 by auid=4294967295
>type=USER_AUTH msg=audit(1169500618.064:6): user pid=2034 uid=0 auid=4294967295 msg='PAM: authentication acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=ttyS0 res=success)'
>type=USER_ACCT msg=audit(1169500618.065:7): user pid=2034 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=ttyS0 res=success)'
>type=LOGIN msg=audit(1169500618.069:8): login pid=2034 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169500618.070:9): user pid=2034 uid=0 auid=0 msg='PAM: session open acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=ttyS0 res=success)'
>type=CRED_ACQ msg=audit(1169500618.077:10): user pid=2034 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=ttyS0 res=success)'
>type=USER_LOGIN msg=audit(1169500618.095:11): user pid=2034 uid=0 auid=0 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=ttyS0 res=success)'
>type=CRED_DISP msg=audit(1169500971.084:12): user pid=2034 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=ttyS0 res=success)'
>type=USER_END msg=audit(1169500971.085:13): user pid=2034 uid=0 auid=0 msg='PAM: session close acct=root : exe="/bin/login" (hostname=?, addr=?, terminal=ttyS0 res=success)'
>type=USER_ACCT msg=audit(1169503261.760:14): user pid=2219 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169503261.760:15): user pid=2219 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169503261.760:16): login pid=2219 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169503261.764:17): user pid=2219 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169503261.822:18): user pid=2219 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169503261.822:19): user pid=2219 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1169506262.799:20): user pid=5017 uid=0 auid=4294967295 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=dhcp80-220.msp.redhat.com, addr=10.15.80.220, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169506262.804:21): user pid=5017 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/sshd" (hostname=dhcp80-220.msp.redhat.com, addr=10.15.80.220, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1169506262.853:22): user pid=5017 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=dhcp80-220.msp.redhat.com, addr=10.15.80.220, terminal=ssh res=success)'
>type=LOGIN msg=audit(1169506262.896:23): login pid=5017 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169506262.899:24): user pid=5017 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/sshd" (hostname=dhcp80-220.msp.redhat.com, addr=10.15.80.220, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1169506263.024:25): user pid=5019 uid=0 auid=0 msg='uid=0: exe="/usr/sbin/sshd" (hostname=dhcp80-220.msp.redhat.com, addr=10.15.80.220, terminal=/dev/pts/0 res=success)'
>type=CRED_REFR msg=audit(1169506263.062:26): user pid=5019 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=dhcp80-220.msp.redhat.com, addr=10.15.80.220, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169506861.983:27): user pid=5061 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169506861.984:28): user pid=5061 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169506861.985:29): login pid=5061 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169506861.989:30): user pid=5061 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169506861.999:31): user pid=5061 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169506862.000:32): user pid=5061 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169510461.107:33): user pid=5211 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169510461.108:34): user pid=5211 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169510461.108:35): login pid=5211 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169510461.113:36): user pid=5211 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169510461.123:37): user pid=5211 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169510461.124:38): user pid=5211 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169514061.232:39): user pid=5328 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169514061.233:40): user pid=5328 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169514061.234:41): login pid=5328 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169514061.238:42): user pid=5328 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169514061.247:43): user pid=5328 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169514061.248:44): user pid=5328 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169517661.358:45): user pid=5429 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169517661.359:46): user pid=5429 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169517661.360:47): login pid=5429 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169517661.364:48): user pid=5429 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169517661.374:49): user pid=5429 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169517661.375:50): user pid=5429 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_LOGIN msg=audit(1169520885.757:51): user pid=5570 uid=0 auid=4294967295 msg='acct=root: exe="/usr/sbin/sshd" (hostname=?, addr=10.13.248.59, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1169520890.466:52): user pid=5570 uid=0 auid=4294967295 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=vpn-248-59.boston.redhat.com, addr=10.13.248.59, terminal=ssh res=failed)'
>type=USER_LOGIN msg=audit(1169520890.467:53): user pid=5570 uid=0 auid=4294967295 msg='acct=root: exe="/usr/sbin/sshd" (hostname=?, addr=10.13.248.59, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1169520893.356:54): user pid=5570 uid=0 auid=4294967295 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=vpn-248-59.boston.redhat.com, addr=10.13.248.59, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169520893.360:55): user pid=5570 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/sshd" (hostname=vpn-248-59.boston.redhat.com, addr=10.13.248.59, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1169520893.366:56): user pid=5570 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=vpn-248-59.boston.redhat.com, addr=10.13.248.59, terminal=ssh res=success)'
>type=LOGIN msg=audit(1169520893.368:57): login pid=5570 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169520893.373:58): user pid=5570 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/sshd" (hostname=vpn-248-59.boston.redhat.com, addr=10.13.248.59, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1169520893.510:59): user pid=5572 uid=0 auid=0 msg='uid=0: exe="/usr/sbin/sshd" (hostname=vpn-248-59.boston.redhat.com, addr=10.13.248.59, terminal=/dev/pts/1 res=success)'
>type=CRED_REFR msg=audit(1169520893.516:60): user pid=5572 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=vpn-248-59.boston.redhat.com, addr=10.13.248.59, terminal=ssh res=success)'
>type=USER_CHAUTHTOK msg=audit(1169520933.334:61): user pid=5599 uid=0 auid=0 msg='op=adding group acct=luci exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1169520933.583:62): user pid=5604 uid=0 auid=0 msg='op=adding user acct=luci exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1169521060.053:63): user pid=5673 uid=0 auid=0 msg='op=adding group acct=ricci exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1169521060.352:64): user pid=5678 uid=0 auid=0 msg='op=adding user acct=ricci exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1169521261.623:65): user pid=5709 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169521261.623:66): user pid=5709 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169521261.624:67): login pid=5709 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169521261.635:68): user pid=5709 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169521261.680:69): user pid=5709 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169521261.681:70): user pid=5709 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169521626.092:71): user pid=5570 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=vpn-248-59.boston.redhat.com, addr=10.13.248.59, terminal=ssh res=success)'
>type=USER_END msg=audit(1169521626.095:72): user pid=5570 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/sshd" (hostname=vpn-248-59.boston.redhat.com, addr=10.13.248.59, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169524861.788:73): user pid=5811 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169524861.789:74): user pid=5811 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169524861.790:75): login pid=5811 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169524861.794:76): user pid=5811 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169524861.803:77): user pid=5811 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169524861.804:78): user pid=5811 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169528461.913:79): user pid=5958 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169528461.914:80): user pid=5958 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169528461.914:81): login pid=5958 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169528461.919:82): user pid=5958 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169528461.929:83): user pid=5958 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169528461.929:84): user pid=5958 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169532061.033:85): user pid=6059 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169532061.034:86): user pid=6059 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169532061.035:87): login pid=6059 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169532061.040:88): user pid=6059 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169532061.049:89): user pid=6059 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169532061.050:90): user pid=6059 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169535661.157:91): user pid=6160 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169535661.158:92): user pid=6160 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169535661.159:93): login pid=6160 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169535661.163:94): user pid=6160 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169535661.172:95): user pid=6160 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169535661.173:96): user pid=6160 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169539261.285:97): user pid=6307 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169539261.285:98): user pid=6307 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169539261.286:99): login pid=6307 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169539261.291:100): user pid=6307 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169539261.300:101): user pid=6307 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169539261.301:102): user pid=6307 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169542861.410:103): user pid=6408 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169542861.411:104): user pid=6408 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169542861.412:105): login pid=6408 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169542861.416:106): user pid=6408 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169542861.425:107): user pid=6408 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169542861.426:108): user pid=6408 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169546461.531:109): user pid=6554 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169546461.532:110): user pid=6554 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169546461.532:111): login pid=6554 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169546461.537:112): user pid=6554 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169546461.546:113): user pid=6554 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169546461.547:114): user pid=6554 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169546521.555:115): user pid=6558 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169546521.556:116): user pid=6558 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169546521.557:117): login pid=6558 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169546521.561:118): user pid=6558 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169546723.455:119): user pid=6558 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169546723.456:120): user pid=6558 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169550061.555:121): user pid=6966 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169550061.556:122): user pid=6966 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169550061.556:123): login pid=6966 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169550061.564:124): user pid=6966 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169550061.574:125): user pid=6966 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169550061.575:126): user pid=6966 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169553661.682:127): user pid=7068 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169553661.683:128): user pid=7068 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169553661.683:129): login pid=7068 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169553661.687:130): user pid=7068 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169553661.696:131): user pid=7068 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169553661.697:132): user pid=7068 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169557261.804:133): user pid=7214 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169557261.805:134): user pid=7214 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169557261.806:135): login pid=7214 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169557261.810:136): user pid=7214 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169557261.820:137): user pid=7214 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169557261.821:138): user pid=7214 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1169560861.932:139): user pid=7317 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169560861.933:140): user pid=7317 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169560861.934:141): login pid=7317 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169560861.938:142): user pid=7317 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169560861.947:143): user pid=7317 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169560861.948:144): user pid=7317 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1169560959.016:145): user pid=7322 uid=0 auid=4294967295 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169560959.019:146): user pid=7322 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1169560959.026:147): user pid=7322 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=LOGIN msg=audit(1169560959.032:148): login pid=7322 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169560959.036:149): user pid=7322 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1169560959.171:150): user pid=7324 uid=0 auid=0 msg='uid=0: exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=/dev/pts/1 res=success)'
>type=CRED_REFR msg=audit(1169560959.194:151): user pid=7324 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_AUTH msg=audit(1169562270.667:152): user pid=7460 uid=0 auid=0 msg='PAM: authentication acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1169562270.669:153): user pid=7460 uid=0 auid=0 msg='PAM: accounting acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1169562294.088:154): user pid=7322 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1169562294.090:155): user pid=5017 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=dhcp80-220.msp.redhat.com, addr=10.15.80.220, terminal=ssh res=success)'
>type=USER_END msg=audit(1169562294.093:156): user pid=7322 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_END msg=audit(1169562294.097:157): user pid=5017 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/sshd" (hostname=dhcp80-220.msp.redhat.com, addr=10.15.80.220, terminal=ssh res=success)'
>type=DAEMON_END msg=audit(1169562298.725:8796) auditd normal halt, sending auid=4294967295 pid=7800 subj= res=success, auditd pid=1542
>type=DAEMON_START msg=audit(1169562404.037:3631) auditd start, ver=1.3.1, format=raw, auid=4294967295 pid=1546 res=success, auditd pid=1546
>type=CONFIG_CHANGE msg=audit(1169562404.136:4): audit_enabled=1 old=0 by auid=4294967295
>type=CONFIG_CHANGE msg=audit(1169562404.257:5): audit_backlog_limit=256 old=64 by auid=4294967295
>type=USER_LOGIN msg=audit(1169563335.580:6): user pid=3756 uid=0 auid=4294967295 msg='acct=root: exe="/usr/sbin/sshd" (hostname=?, addr=172.16.80.49, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1169563338.061:7): user pid=3756 uid=0 auid=4294967295 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169563338.065:8): user pid=3756 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1169563338.072:9): user pid=3756 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=LOGIN msg=audit(1169563338.076:10): login pid=3756 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169563338.080:11): user pid=3756 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1169563338.167:12): user pid=3764 uid=0 auid=0 msg='uid=0: exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=/dev/pts/0 res=success)'
>type=CRED_REFR msg=audit(1169563338.197:13): user pid=3764 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_AUTH msg=audit(1169563889.210:14): user pid=2097 uid=0 auid=4294967295 msg='PAM: authentication acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1169563889.212:15): user pid=2097 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1169563907.608:16): user pid=3756 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_END msg=audit(1169563907.612:17): user pid=3756 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=DAEMON_END msg=audit(1169563912.043:3632) auditd normal halt, sending auid=4294967295 pid=4155 subj= res=success, auditd pid=1546
>type=DAEMON_START msg=audit(1169564019.036:483) auditd start, ver=1.3.1, format=raw, auid=4294967295 pid=1560 res=success, auditd pid=1560
>type=CONFIG_CHANGE msg=audit(1169564019.137:4): audit_enabled=1 old=0 by auid=4294967295
>type=CONFIG_CHANGE msg=audit(1169564019.224:5): audit_backlog_limit=256 old=64 by auid=4294967295
>type=USER_ACCT msg=audit(1169564461.975:6): user pid=3029 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169564461.975:7): user pid=3029 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169564461.976:8): login pid=3029 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169564461.979:9): user pid=3029 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169564462.055:10): user pid=3029 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169564462.055:11): user pid=3029 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1169564600.378:12): user pid=2111 uid=0 auid=4294967295 msg='PAM: authentication acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1169564600.379:13): user pid=2111 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1169565229.896:14): user pid=3538 uid=0 auid=4294967295 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169565229.900:15): user pid=3538 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1169565229.924:16): user pid=3538 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=LOGIN msg=audit(1169565229.926:17): login pid=3538 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169565229.929:18): user pid=3538 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1169565230.006:19): user pid=3540 uid=0 auid=0 msg='uid=0: exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=/dev/pts/0 res=success)'
>type=CRED_REFR msg=audit(1169565230.037:20): user pid=3540 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1169565453.973:21): user pid=3538 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_END msg=audit(1169565453.977:22): user pid=3538 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=DAEMON_END msg=audit(1169565458.425:484) auditd normal halt, sending auid=4294967295 pid=3902 subj= res=success, auditd pid=1560
>type=DAEMON_START msg=audit(1169565561.047:3295) auditd start, ver=1.3.1, format=raw, auid=4294967295 pid=1567 res=success, auditd pid=1567
>type=CONFIG_CHANGE msg=audit(1169565561.146:4): audit_enabled=1 old=0 by auid=4294967295
>type=CONFIG_CHANGE msg=audit(1169565561.226:5): audit_backlog_limit=256 old=64 by auid=4294967295
>type=USER_AUTH msg=audit(1169566113.199:6): user pid=3182 uid=0 auid=4294967295 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169566113.202:7): user pid=3182 uid=0 auid=4294967295 msg='PAM: accounting acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1169566113.210:8): user pid=3182 uid=0 auid=4294967295 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=LOGIN msg=audit(1169566113.217:9): login pid=3182 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169566113.220:10): user pid=3182 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1169566113.312:11): user pid=3190 uid=0 auid=0 msg='uid=0: exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=/dev/pts/0 res=success)'
>type=CRED_REFR msg=audit(1169566113.343:12): user pid=3190 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1169566158.419:13): user pid=3182 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_END msg=audit(1169566158.423:14): user pid=3182 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=DAEMON_END msg=audit(1169566166.534:3296) auditd normal halt, sending auid=4294967295 pid=3657 subj= res=success, auditd pid=1567
>type=DAEMON_START msg=audit(1169566502.524:8776) auditd start, ver=1.3.1, format=raw, auid=4294967295 pid=1565 res=success, auditd pid=1565
>type=CONFIG_CHANGE msg=audit(1169566502.625:5): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0
>type=CONFIG_CHANGE msg=audit(1169566502.703:6): audit_backlog_limit=256 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0
>type=AVC msg=audit(1169566510.494:7): avc:  denied  { search } for  pid=1722 comm="aisexec" name="lib" dev=dm-0 ino=359042 scontext=system_u:system_r:ccs_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1169566510.494:7): arch=40000003 syscall=39 success=no exit=-13 a0=806c065 a1=1c0 a2=80729d8 a3=8076f2c items=0 ppid=1 pid=1722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="aisexec" exe="/usr/sbin/aisexec" subj=system_u:system_r:ccs_t:s0 key=(null)
>type=AVC msg=audit(1169566510.495:8): avc:  denied  { search } for  pid=1722 comm="aisexec" name="lib" dev=dm-0 ino=359042 scontext=system_u:system_r:ccs_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1169566510.495:8): arch=40000003 syscall=12 success=no exit=-13 a0=806c065 a1=ffffffcc a2=80729d8 a3=8076f2c items=0 ppid=1 pid=1722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="aisexec" exe="/usr/sbin/aisexec" subj=system_u:system_r:ccs_t:s0 key=(null)
>type=AVC msg=audit(1169566510.497:9): avc:  denied  { search } for  pid=1722 comm="aisexec" name="lib" dev=dm-0 ino=359042 scontext=system_u:system_r:ccs_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1169566510.497:9): arch=40000003 syscall=5 success=no exit=-13 a0=bfafbb08 a1=0 a2=1c0 a3=0 items=0 ppid=1 pid=1722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="aisexec" exe="/usr/sbin/aisexec" subj=system_u:system_r:ccs_t:s0 key=(null)
>type=AVC msg=audit(1169566510.500:10): avc:  denied  { write } for  pid=1722 comm="aisexec" name="ringid_10.15.89.174" dev=dm-0 ino=2284808 scontext=system_u:system_r:ccs_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
>type=SYSCALL msg=audit(1169566510.500:10): arch=40000003 syscall=5 success=no exit=-13 a0=bfafbaf4 a1=1 a2=1ff a3=806bf94 items=0 ppid=1 pid=1722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="aisexec" exe="/usr/sbin/aisexec" subj=system_u:system_r:ccs_t:s0 key=(null)
>type=AVC msg=audit(1169566510.500:11): avc:  denied  { read write } for  pid=1722 comm="aisexec" name="ringid_10.15.89.174" dev=dm-0 ino=2284808 scontext=system_u:system_r:ccs_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
>type=SYSCALL msg=audit(1169566510.500:11): arch=40000003 syscall=5 success=no exit=-13 a0=bfafbaf4 a1=42 a2=1ff a3=ffffffff items=0 ppid=1 pid=1722 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="aisexec" exe="/usr/sbin/aisexec" subj=system_u:system_r:ccs_t:s0 key=(null)
>type=AVC msg=audit(1169566510.623:12): avc:  denied  { write } for  pid=1722 comm="aisexec" name="sbin" dev=dm-0 ino=1305602 scontext=system_u:system_r:ccs_t:s0 tcontext=system_u:object_r:sbin_t:s0 tclass=dir
>type=USER_AUTH msg=audit(1169566584.036:13): user pid=2427 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169566584.040:14): user pid=2427 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1169566584.199:15): user pid=2427 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=LOGIN msg=audit(1169566584.203:16): login pid=2427 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169566584.208:17): user pid=2427 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1169566584.290:18): user pid=2435 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=0: exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=/dev/pts/0 res=success)'
>type=CRED_REFR msg=audit(1169566584.337:19): user pid=2435 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169568061.896:20): user pid=4337 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169568061.903:21): user pid=4337 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169568061.903:22): login pid=4337 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169568061.910:23): user pid=4337 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169568061.981:24): user pid=4337 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169568061.982:25): user pid=4337 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1169570833.872:26): avc:  denied  { read } for  pid=6373 comm="mdadm" name="sg2" dev=tmpfs ino=3849 scontext=system_u:system_r:mdadm_t:s0 tcontext=system_u:object_r:scsi_generic_device_t:s0 tclass=chr_file
>type=SYSCALL msg=audit(1169570833.872:26): arch=40000003 syscall=5 success=no exit=-13 a0=8879888 a1=0 a2=0 a3=1 items=0 ppid=6364 pid=6373 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mdadm" exe="/sbin/mdadm" subj=system_u:system_r:mdadm_t:s0 key=(null)
>type=AVC msg=audit(1169570834.195:27): avc:  denied  { read } for  pid=6373 comm="mdadm" name="rtc" dev=tmpfs ino=629 scontext=system_u:system_r:mdadm_t:s0 tcontext=system_u:object_r:clock_device_t:s0 tclass=chr_file
>type=SYSCALL msg=audit(1169570834.195:27): arch=40000003 syscall=5 success=no exit=-13 a0=88797d8 a1=0 a2=0 a3=1 items=0 ppid=6364 pid=6373 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="mdadm" exe="/sbin/mdadm" subj=system_u:system_r:mdadm_t:s0 key=(null)
>type=AVC msg=audit(1169570836.012:28): avc:  denied  { read } for  pid=6397 comm="modinfo" name="gfs.ko" dev=dm-0 ino=3396788 scontext=system_u:system_r:ricci_modstorage_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=file
>type=SYSCALL msg=audit(1169570836.012:28): arch=40000003 syscall=5 success=no exit=-13 a0=9926090 a1=0 a2=1b6 a3=992c630 items=0 ppid=6364 pid=6397 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="modinfo" exe="/sbin/modinfo" subj=system_u:system_r:ricci_modstorage_t:s0 key=(null)
>type=USER_ACCT msg=audit(1169571661.411:29): user pid=7377 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169571661.415:30): user pid=7377 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169571661.416:31): login pid=7377 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169571661.421:32): user pid=7377 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169571661.476:33): user pid=7377 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169571661.477:34): user pid=7377 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1169572433.754:35): user pid=2232 uid=0 auid=4294967295 subj=system_u:system_r:saslauthd_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1169572433.760:36): user pid=2232 uid=0 auid=4294967295 subj=system_u:system_r:saslauthd_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1169575261.335:37): user pid=7484 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1169575261.339:38): user pid=7484 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1169575261.339:39): login pid=7484 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169575261.344:40): user pid=7484 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1169575261.357:41): user pid=7484 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1169575261.358:42): user pid=7484 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1169576521.725:43): avc:  denied  { search } for  pid=7572 comm="ricci-modrpm" name="sys" dev=proc ino=-268435428 scontext=system_u:system_r:ricci_modrpm_t:s0 tcontext=system_u:object_r:sysctl_t:s0 tclass=dir
>type=SYSCALL msg=audit(1169576521.725:43): arch=40000003 syscall=33 success=no exit=-13 a0=82d20ec a1=4 a2=8097490 a3=bfc73fa4 items=0 ppid=2200 pid=7572 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ricci-modrpm" exe="/usr/libexec/ricci-modrpm" subj=system_u:system_r:ricci_modrpm_t:s0 key=(null)
>type=CRED_DISP msg=audit(1169577239.435:44): user pid=2427 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_END msg=audit(1169577239.442:45): user pid=2427 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=DAEMON_END msg=audit(1169577242.412:8777) auditd normal halt, sending auid=4294967295 pid=7969 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1565
>type=DAEMON_START msg=audit(1169577350.389:3811) auditd start, ver=1.3.1, format=raw, auid=4294967295 pid=1575 res=success, auditd pid=1575
>type=CONFIG_CHANGE msg=audit(1169577350.489:5): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0
>type=CONFIG_CHANGE msg=audit(1169577350.559:6): audit_backlog_limit=256 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0
>type=USER_AUTH msg=audit(1169577623.661:7): user pid=2184 uid=0 auid=4294967295 subj=system_u:system_r:saslauthd_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1169577623.668:8): user pid=2184 uid=0 auid=4294967295 subj=system_u:system_r:saslauthd_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1169577632.754:9): avc:  denied  { search } for  pid=2301 comm="ricci-modrpm" name="sys" dev=proc ino=-268435428 scontext=system_u:system_r:ricci_modrpm_t:s0 tcontext=system_u:object_r:sysctl_t:s0 tclass=dir
>type=SYSCALL msg=audit(1169577632.754:9): arch=40000003 syscall=33 success=no exit=-13 a0=90980ec a1=4 a2=8097490 a3=bf9baf74 items=0 ppid=2152 pid=2301 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ricci-modrpm" exe="/usr/libexec/ricci-modrpm" subj=system_u:system_r:ricci_modrpm_t:s0 key=(null)
>type=USER_AUTH msg=audit(1169577667.282:10): user pid=2308 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169577667.286:11): user pid=2308 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1169577667.439:12): user pid=2308 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=LOGIN msg=audit(1169577667.443:13): login pid=2308 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169577667.447:14): user pid=2308 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1169577667.543:15): user pid=2310 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=0: exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=/dev/pts/0 res=success)'
>type=CRED_REFR msg=audit(1169577667.574:16): user pid=2310 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=MAC_STATUS msg=audit(1169577818.977:17): enforcing=0 old_enforcing=1 auid=0
>type=SYSCALL msg=audit(1169577818.977:17): arch=40000003 syscall=4 success=yes exit=1 a0=3 a1=bffb81d4 a2=1 a3=bffb81d4 items=0 ppid=2310 pid=2341 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 comm="setenforce" exe="/usr/sbin/setenforce" subj=root:system_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1169578015.545:18): user pid=2185 uid=0 auid=4294967295 subj=system_u:system_r:saslauthd_t:s0 msg='PAM: authentication acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1169578015.546:19): user pid=2185 uid=0 auid=4294967295 subj=system_u:system_r:saslauthd_t:s0 msg='PAM: accounting acct=root : exe="/usr/sbin/saslauthd" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1169578022.423:20): avc:  denied  { search } for  pid=2375 comm="ricci-modrpm" name="sys" dev=proc ino=-268435428 scontext=system_u:system_r:ricci_modrpm_t:s0 tcontext=system_u:object_r:sysctl_t:s0 tclass=dir
>type=AVC msg=audit(1169578022.423:20): avc:  denied  { search } for  pid=2375 comm="ricci-modrpm" name="kernel" dev=proc ino=-268435416 scontext=system_u:system_r:ricci_modrpm_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=dir
>type=AVC msg=audit(1169578022.423:20): avc:  denied  { read } for  pid=2375 comm="ricci-modrpm" name="osrelease" dev=proc ino=-268435414 scontext=system_u:system_r:ricci_modrpm_t:s0 tcontext=system_u:object_r:sysctl_kernel_t:s0 tclass=file
>type=SYSCALL msg=audit(1169578022.423:20): arch=40000003 syscall=33 success=yes exit=0 a0=94120ec a1=4 a2=8097490 a3=bfcf0594 items=0 ppid=2152 pid=2375 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ricci-modrpm" exe="/usr/libexec/ricci-modrpm" subj=system_u:system_r:ricci_modrpm_t:s0 key=(null)
>type=CRED_DISP msg=audit(1169578034.110:21): user pid=2308 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_END msg=audit(1169578034.116:22): user pid=2308 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=DAEMON_END msg=audit(1169578038.955:3812) auditd normal halt, sending auid=4294967295 pid=2718 subj=system_u:system_r:initrc_t:s0 res=success, auditd pid=1575
>type=DAEMON_START msg=audit(1169578145.354:6881) auditd start, ver=1.3.1, format=raw, auid=4294967295 pid=1570 res=success, auditd pid=1570
>type=CONFIG_CHANGE msg=audit(1169578145.454:5): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0
>type=CONFIG_CHANGE msg=audit(1169578145.548:6): audit_backlog_limit=256 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0
>type=AVC msg=audit(1169578176.313:7): avc:  denied  { search } for  pid=2182 comm="ricci-modrpm" name="sys" dev=proc ino=-268435428 scontext=system_u:system_r:ricci_modrpm_t:s0 tcontext=system_u:object_r:sysctl_t:s0 tclass=dir
>type=SYSCALL msg=audit(1169578176.313:7): arch=40000003 syscall=33 success=no exit=-13 a0=98d58fc a1=4 a2=8097490 a3=bfdd23d4 items=0 ppid=2126 pid=2182 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="ricci-modrpm" exe="/usr/libexec/ricci-modrpm" subj=system_u:system_r:ricci_modrpm_t:s0 key=(null)
>type=USER_AUTH msg=audit(1169578260.511:8): user pid=2379 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169578260.515:9): user pid=2379 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1169578260.697:10): user pid=2379 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=LOGIN msg=audit(1169578260.701:11): login pid=2379 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169578260.704:12): user pid=2379 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1169578260.796:13): user pid=2387 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=0: exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=/dev/pts/0 res=success)'
>type=CRED_REFR msg=audit(1169578260.828:14): user pid=2387 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_AUTH msg=audit(1169578638.638:15): user pid=2871 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1169578638.643:16): user pid=2871 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1169578638.775:17): user pid=2871 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=LOGIN msg=audit(1169578638.776:18): login pid=2871 uid=0 old auid=4294967295 new auid=0
>type=USER_START msg=audit(1169578638.781:19): user pid=2871 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1169578638.856:20): user pid=2879 uid=0 auid=0 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct=root : exe="/usr/sbin/sshd" (hostname=atlantis.boston.redhat.com, addr=172.16.80.49, terminal=ssh res=success)'

Actions: View

Attachments on bug 224028: 146337