Attachment 310198 Details for Bug 452770 – contents of /var/log/audit/audit.log from current boot

contents of /var/log/audit/audit.log from current boot

log.txt (text/plain), 6.12 KB, created by Tom London on 2008-06-24 22:48:56 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tom London

Created: 2008-06-24 22:48:56 UTC

Size: 6.12 KB

patch

obsolete

>type=DAEMON_START msg=audit(1214346393.077:532): auditd start, ver=1.7.4 format=raw kernel=2.6.26-0.87.rc7.git2.fc10.i686 auid=4294967295 pid=2291 res=success
>type=CONFIG_CHANGE msg=audit(1214346393.324:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1214346427.843:5): user pid=2721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=Cups-PDF uri=cups-pdf:/ banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=::1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1214346428.155:6): user pid=2721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=HP5MP uri=hp:/par/HP_LaserJet_5MP?device=/dev/parport0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=::1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1214346428.441:7): user pid=2721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=hp_laserjet_1300 uri=file:/dev/null banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=::1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1214346428.477:8): user pid=2721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=hp_LaserJet_1300_USB_1 uri=usb://HP/LaserJet%201300 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=::1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1214346428.544:9): user pid=2721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=Kyocera_FS-C5030N_on_dc1 uri=socket://10.10.3.49:9100 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=::1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1214346428.665:10): user pid=2721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=SavinColor uri=ipp://10.10.3.47/ipp/ banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=::1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1214346428.813:11): user pid=2721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=Innopath uri=file:/dev/null banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=::1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1214346428.813:12): user pid=2721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=Local uri=file:/dev/null banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=::1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1214346573.621:13): user pid=2955 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="tbl" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=failed)'
>type=USER_LOGIN msg=audit(1214346573.626:14): user pid=2955 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty8 res=failed)'
>type=USER_AUTH msg=audit(1214346615.352:15): user pid=3061 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="tbl" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1214346615.360:16): user pid=3061 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="tbl" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1214346615.401:17): user pid=3061 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="tbl" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1214346615.480:18): login pid=3061 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1214346615.585:19): user pid=3061 uid=0 auid=500 ses=1 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0 selected-context=unconfined_u:unconfined_r:unconfined_t:s0: exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1214346615.798:20): user pid=3061 uid=0 auid=500 ses=1 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="tbl" exe="/usr/libexec/gdm-session-worker" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1214346615.903:21): user pid=3061 uid=0 auid=500 ses=1 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/libexec/gdm-session-worker" (hostname=, addr=?, terminal=/dev/tty8 res=success)'
>type=ANOM_ABEND msg=audit(1214346792.181:22): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_execmem_t:s0 pid=3490 comm="rhythmbox" sig=6
>type=CRED_ACQ msg=audit(1214347091.426:23): user pid=4037 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" (hostname=localhost.localdomain, addr=::1, terminal=/dev/pts/0 res=success)'
>type=USER_START msg=audit(1214347091.439:24): user pid=4037 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" (hostname=localhost.localdomain, addr=::1, terminal=/dev/pts/0 res=success)'
>type=USER_END msg=audit(1214347091.439:25): user pid=4037 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" (hostname=localhost.localdomain, addr=::1, terminal=/dev/pts/0 res=success)'
>type=USER_CMD msg=audit(1214347091.440:26): user pid=4037 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0 msg='cwd="/root" cmd="/bin/bash" (terminal=pts/0 res=success)'

Actions: View

Attachments on bug 452770: 310198