Attachment 316087 Details for Bug 461346 – log file used to create local.te /var/log/audit/audit.log

[patch] log file used to create local.te /var/log/audit/audit.log

audit.log (text/plain), 198.69 KB, created by Martin Kuhnke on 2008-09-08 14:27:44 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martin Kuhnke

Created: 2008-09-08 14:27:44 UTC

Size: 198.69 KB

patch

obsolete

>type=DAEMON_START msg=audit(1220292960.091:8505): auditd start, ver=1.6.5 format=raw kernel=2.6.23.14-115.fc8 auid=4294967295 pid=1730 res=success
>type=CONFIG_CHANGE msg=audit(1220292960.191:5): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1220292960.191:6): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1220292960.223:7): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1220292960.223:8): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=USYS_CONFIG msg=audit(1220285932.499:9): user pid=2444 uid=0 auid=4294967295 subj=system_u:system_r:firstboot_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_AUTH msg=audit(1220286110.752:10): user pid=2527 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=failed)'
>type=USER_LOGIN msg=audit(1220286110.760:11): user pid=2527 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='acct=unknown: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=?, terminal=:0 res=failed)'
>type=USER_AUTH msg=audit(1220286129.082:12): user pid=2527 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220286129.104:13): user pid=2527 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220286129.114:14): user pid=2527 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220286129.117:15): login pid=2527 uid=0 old auid=4294967295 new auid=500
>type=USER_ROLE_CHANGE msg=audit(1220286129.167:16): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0 selected-context=unconfined_u:system_r:unconfined_t:s0: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220286129.203:17): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220286129.204:18): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220286154.689:19): user pid=2751 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:authentication acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1220286191.849:20): user pid=2757 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:authentication acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220286191.849:21): user pid=2757 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:accounting acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220286191.944:22): user pid=2757 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:session_open acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220286360.614:23): user pid=2757 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:session_close acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220286364.874:24): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220286364.875:25): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220286379.788:26): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220286379.794:27): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220286379.794:28): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220286379.795:29): login pid=2527 uid=0 old auid=500 new auid=500
>type=USER_ROLE_CHANGE msg=audit(1220286379.814:30): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0 selected-context=unconfined_u:system_r:unconfined_t:s0: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220286379.827:31): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220286379.827:32): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_END msg=audit(1220286413.707:33): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220286413.707:34): user pid=2527 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220286416.028:8506): auditd normal halt, sending auid=4294967295 pid=3114 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220286461.275:219): auditd start, ver=1.6.5 format=raw kernel=2.6.23.14-115.fc8 auid=4294967295 pid=1725 res=success
>type=CONFIG_CHANGE msg=audit(1220286461.374:5): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1220286461.374:6): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1220286461.388:7): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1220286461.388:8): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=USER_AUTH msg=audit(1220286477.640:9): user pid=2136 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=? exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=failed)'
>type=USER_LOGIN msg=audit(1220286477.655:10): user pid=2136 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='acct=unknown: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=?, terminal=:0 res=failed)'
>type=USER_AUTH msg=audit(1220286490.077:11): user pid=2136 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=failed)'
>type=USER_LOGIN msg=audit(1220286490.077:12): user pid=2136 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='acct=unknown: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=?, terminal=:0 res=failed)'
>type=USER_AUTH msg=audit(1220286500.098:13): user pid=2136 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220286500.124:14): user pid=2136 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220286500.144:15): user pid=2136 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220286500.151:16): login pid=2136 uid=0 old auid=4294967295 new auid=500
>type=USER_ROLE_CHANGE msg=audit(1220286500.197:17): user pid=2136 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0 selected-context=unconfined_u:system_r:unconfined_t:s0: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220286500.232:18): user pid=2136 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220286500.232:19): user pid=2136 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=?, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220286526.405:20): user pid=2356 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:authentication acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220286526.405:21): user pid=2356 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:accounting acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220286526.463:22): user pid=2356 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:session_open acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220286563.000:23): user pid=2356 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:session_close acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220286566.060:24): user pid=2371 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:authentication acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220286566.060:25): user pid=2371 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:accounting acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220286566.070:26): user pid=2371 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:session_open acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1220286983.457:27): user pid=2560 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct="dbus" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1220286990.478:28): user pid=2590 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct="polkituser" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1220287057.230:29): user pid=5187 uid=0 auid=500 subj=system_u:system_r:groupadd_t:s0 msg='op=adding group acct="ntp" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1220287057.233:30): user pid=5188 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct="ntp" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1220287089.241:31): user pid=5247 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AVC msg=audit(1220287164.152:32): user pid=1741 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=MAC_POLICY_LOAD msg=audit(1220287163.828:33): policy loaded auid=500
>type=SYSCALL msg=audit(1220287163.828:33): arch=40000003 syscall=4 success=yes exit=4141854 a0=4 a1=b7b3d000 a2=3f331e a3=bf96ee68 items=0 ppid=5473 pid=5474 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="load_policy" exe="/usr/sbin/load_policy" subj=system_u:system_r:load_policy_t:s0 key=(null)
>type=USER_CHAUTHTOK msg=audit(1220287179.904:34): user pid=5910 uid=0 auid=500 subj=system_u:system_r:groupadd_t:s0 msg='op=adding group acct="smolt" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1220287179.955:35): user pid=5914 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct="smolt" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1220287202.358:36): user pid=5940 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct="haldaemon" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1220287206.532:37): user pid=5979 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct="gdm" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_CHAUTHTOK msg=audit(1220287206.534:38): user pid=5980 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=changing user shell acct="gdm" exe="/usr/sbin/usermod" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ROLE_CHANGE msg=audit(1220287219.865:39): user pid=6035 uid=0 auid=500 subj=system_u:system_r:semanage_t:s0 msg='op=add SELinux user record acct="unconfined_u" old-seuser=? old-role=? old-range=? new-seuser=unconfined_u new-role=unconfined_r system_r new-range=s0-s0:c0.c1023 exe=/usr/sbin/semanage (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_ROLE_CHANGE msg=audit(1220287221.375:40): user pid=6036 uid=0 auid=500 subj=system_u:system_r:semanage_t:s0 msg='op=modify SELinux user record acct="unconfined_u" old-seuser=? old-role=system_r unconfined_r old-range=s0-s0:c0.c1023 new-seuser=? new-role=unconfined_r system_r system_r unconfined_r new-range=s0-s0:c0.c1023 exe=/usr/sbin/semanage (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AVC msg=audit(1220287232.487:41): user pid=1741 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received policyload notice (seqno=3) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=MAC_POLICY_LOAD msg=audit(1220287232.137:42): policy loaded auid=500
>type=SYSCALL msg=audit(1220287232.137:42): arch=40000003 syscall=4 success=yes exit=4141854 a0=4 a1=b7bf3000 a2=3f331e a3=bfed3558 items=0 ppid=6037 pid=6038 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="load_policy" exe="/usr/sbin/load_policy" subj=system_u:system_r:load_policy_t:s0 key=(null)
>type=USER_ROLE_CHANGE msg=audit(1220287233.118:43): user pid=6037 uid=0 auid=500 subj=system_u:system_r:semanage_t:s0 msg='op=modify selinux user mapping acct="__default__" old-seuser=unconfined_u old-role=? old-range=s0 new-seuser=unconfined_u new-role=? new-range=s0-s0:c0.c1023 exe=/usr/sbin/semanage (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ROLE_CHANGE msg=audit(1220287234.735:44): user pid=6041 uid=0 auid=500 subj=system_u:system_r:semanage_t:s0 msg='op=add SELinux user record acct="unconfined_u" old-seuser=? old-role=? old-range=? new-seuser=unconfined_u new-role=unconfined_r system_r new-range=s0-s0:c0.c1023 exe=/usr/sbin/semanage (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_ROLE_CHANGE msg=audit(1220287236.289:45): user pid=6042 uid=0 auid=500 subj=system_u:system_r:semanage_t:s0 msg='op=modify SELinux user record acct="unconfined_u" old-seuser=? old-role=system_r unconfined_r old-range=s0-s0:c0.c1023 new-seuser=? new-role=unconfined_r system_r system_r unconfined_r new-range=s0-s0:c0.c1023 exe=/usr/sbin/semanage (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AVC msg=audit(1220287247.321:46): user pid=1741 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received policyload notice (seqno=4) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=MAC_POLICY_LOAD msg=audit(1220287246.970:47): policy loaded auid=500
>type=SYSCALL msg=audit(1220287246.970:47): arch=40000003 syscall=4 success=yes exit=4141854 a0=4 a1=b7b61000 a2=3f331e a3=bfd7ba78 items=0 ppid=6045 pid=6046 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="load_policy" exe="/usr/sbin/load_policy" subj=system_u:system_r:load_policy_t:s0 key=(null)
>type=USER_ROLE_CHANGE msg=audit(1220287247.791:48): user pid=6045 uid=0 auid=500 subj=system_u:system_r:semanage_t:s0 msg='op=modify selinux user mapping acct="__default__" old-seuser=unconfined_u old-role=? old-range=s0-s0:c0.c1023 new-seuser=unconfined_u new-role=? new-range=s0-s0:c0.c1023 exe=/usr/sbin/semanage (hostname=?, addr=?, terminal=? res=success)'
>type=DAEMON_END msg=audit(1220287304.548:220): auditd normal halt, sending auid=500 pid=6432 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220287304.644:166): auditd start, ver=1.7.4 format=raw kernel=2.6.23.14-115.fc8 auid=500 pid=6448 res=success
>type=SYSCALL msg=audit(1220287304.646:52): arch=40000003 syscall=97 success=no exit=-13 a0=0 a1=0 a2=fffffff8 a3=ffffffc8 items=0 ppid=6448 pid=6450 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="audispd" exe="/sbin/audispd" subj=system_u:system_r:audisp_t:s0 key=(null)
>type=CONFIG_CHANGE msg=audit(1220287304.646:53): audit_enabled=1 old=1 by auid=500 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1220287304.646:54): audit_enabled=1 old=1 by auid=500 res=1
>type=CONFIG_CHANGE msg=audit(1220287304.652:55): audit_backlog_limit=320 old=320 by auid=500 subj=system_u:system_r:auditctl_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1220287304.652:56): audit_backlog_limit=320 old=320 by auid=500 res=1
>type=USER_END msg=audit(1220287370.480:57): user pid=2136 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220287370.481:58): user pid=2136 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=mrtn exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1220287370.721:59): user pid=2371 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0 msg='op=PAM:session_close acct=root exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=DAEMON_END msg=audit(1220287373.845:167): auditd normal halt, sending auid=4294967295 pid=6639 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220287423.759:6985): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1743 res=success
>type=CONFIG_CHANGE msg=audit(1220287423.841:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1220287448.126:6): user pid=2180 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220287448.131:7): user pid=2180 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220287448.133:8): user pid=2180 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220287448.153:9): login pid=2180 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220287448.239:10): user pid=2180 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220287448.268:11): user pid=2180 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220287448.270:12): user pid=2180 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_END msg=audit(1220287867.684:13): user pid=2180 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220287867.684:14): user pid=2180 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220287870.021:6986): auditd normal halt, sending auid=0 pid=2576 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220288280.767:9186): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1736 res=success
>type=CONFIG_CHANGE msg=audit(1220288280.872:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1220288310.241:6): user pid=2154 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220288310.245:7): user pid=2154 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220288310.246:8): user pid=2154 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220288310.248:9): login pid=2154 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220288310.302:10): user pid=2154 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220288310.322:11): user pid=2154 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220288310.323:12): user pid=2154 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_END msg=audit(1220288431.378:13): user pid=2154 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220288431.378:14): user pid=2154 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220288433.730:9187): auditd normal halt, sending auid=0 pid=2526 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220291978.834:1918): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1740 res=success
>type=CONFIG_CHANGE msg=audit(1220291978.927:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1220292006.043:6): user pid=2160 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220292006.049:7): user pid=2160 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220292006.059:8): user pid=2160 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220292006.068:9): login pid=2160 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220292006.129:10): user pid=2160 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220292006.158:11): user pid=2160 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220292006.160:12): user pid=2160 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220292061.697:13): user pid=2373 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220292061.698:14): user pid=2373 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220292061.699:15): login pid=2373 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220292061.700:16): user pid=2373 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220292061.732:17): user pid=2373 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220292061.732:18): user pid=2373 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1220292272.808:19): user pid=2642 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220292272.808:20): user pid=2642 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220292272.880:21): user pid=2642 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220292380.487:22): user pid=2642 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220292429.940:23): user pid=2653 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220292429.941:24): user pid=2653 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220292429.950:25): user pid=2653 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220292441.880:26): user pid=2653 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1220292469.272:27): user pid=1947 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=usb://Canon/LBP2900 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220292490.286:28): user pid=2691 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220292490.286:29): user pid=2691 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220292490.296:30): user pid=2691 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220292538.191:31): user pid=2691 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220292728.570:32): user pid=2160 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220292728.571:33): user pid=2160 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220292730.868:1919): auditd normal halt, sending auid=0 pid=2874 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220333870.834:6212): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1744 res=success
>type=CONFIG_CHANGE msg=audit(1220333870.927:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220333874.945:6): user pid=1947 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=usb://Canon/LBP2900 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220333914.704:7): user pid=2174 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220333914.708:8): user pid=2174 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220333914.708:9): user pid=2174 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220333914.711:10): login pid=2174 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220333914.764:11): user pid=2174 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220333914.782:12): user pid=2174 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220333914.783:13): user pid=2174 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220334817.517:14): user pid=2730 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220334817.518:15): user pid=2730 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220334817.578:16): user pid=2730 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220334855.948:17): user pid=2743 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220334855.949:18): user pid=2743 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220334855.959:19): user pid=2743 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220334908.319:20): user pid=2743 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220335261.563:21): user pid=3083 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220335261.564:22): user pid=3083 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220335261.564:23): login pid=3083 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220335261.567:24): user pid=3083 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220335261.598:25): user pid=3083 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220335261.598:26): user pid=3083 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220335547.220:27): user pid=2730 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220336115.349:28): user pid=2174 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220336115.351:29): user pid=2174 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220336117.710:6213): auditd normal halt, sending auid=0 pid=3534 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220367735.851:497): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1735 res=success
>type=CONFIG_CHANGE msg=audit(1220367735.952:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220367739.869:6): user pid=1938 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=usb://Canon/LBP2900 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220367771.214:7): user pid=2153 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220367771.217:8): user pid=2153 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220367771.218:9): user pid=2153 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220367771.221:10): login pid=2153 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220367771.275:11): user pid=2153 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220367771.297:12): user pid=2153 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220367771.299:13): user pid=2153 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=ANOM_ABEND msg=audit(1220368029.858:14): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 pid=2378 comm="xarchiver" sig=6
>type=ANOM_ABEND msg=audit(1220368221.042:15): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 pid=2395 comm="xarchiver" sig=6
>type=ANOM_ABEND msg=audit(1220368403.396:16): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 pid=3025 comm="xarchiver" sig=6
>type=ANOM_ABEND msg=audit(1220368487.488:17): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 pid=3042 comm="xarchiver" sig=6
>type=USER_AUTH msg=audit(1220369231.137:18): user pid=3657 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220369231.141:19): user pid=3657 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220369231.199:20): user pid=3657 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220369231.200:21): user pid=3657 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1220369824.640:22): user pid=3704 uid=0 auid=500 subj=unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=usb://Canon/LBP2900 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=CRED_DISP msg=audit(1220371059.498:23): user pid=3657 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220371059.499:24): user pid=3657 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1220371199.458:25): user pid=4424 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220371199.462:26): user pid=4424 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220371199.471:27): user pid=4424 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220371199.472:28): user pid=4424 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220371261.874:29): user pid=4444 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220371261.876:30): user pid=4444 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220371261.876:31): login pid=4444 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220371261.879:32): user pid=4444 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220371261.918:33): user pid=4444 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220371261.919:34): user pid=4444 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1220371432.333:35): user pid=4496 uid=0 auid=500 subj=unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=usb://Canon/LBP2900 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1220371512.983:36): user pid=4496 uid=0 auid=500 subj=unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=usb://Canon/LBP2900 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1220371512.994:37): user pid=4496 uid=0 auid=500 subj=unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1220371512.999:38): user pid=4496 uid=0 auid=500 subj=unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=ANOM_ABEND msg=audit(1220371616.628:39): auid=500 uid=0 gid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 pid=4510 comm="ccpd" sig=11
>type=AVC msg=audit(1220371748.300:40): avc:  denied  { write } for  pid=4553 comm="ccp" name="fifo0" dev=dm-0 ino=394171 scontext=unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1220371748.300:40): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bf95ffe0 a1=81 a2=3f0 a3=bf95ffe0 items=0 ppid=4496 pid=4553 auid=500 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=1 comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=unconfined_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1220371819.560:41): user pid=4424 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220371819.561:42): user pid=4424 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220371854.489:43): user pid=2153 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220371854.490:44): user pid=2153 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220371857.011:498): auditd normal halt, sending auid=0 pid=4722 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220371908.801:3981): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1753 res=success
>type=CONFIG_CHANGE msg=audit(1220371908.888:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220371912.912:6): user pid=1956 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1220371913.416:7): avc:  denied  { write } for  pid=1964 comm="ccp" name="fifo0" dev=dm-0 ino=394171 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1220371913.416:7): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bfe08490 a1=81 a2=3f0 a3=bfe08490 items=0 ppid=1956 pid=1964 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1220371932.568:8): user pid=2197 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220371932.573:9): user pid=2197 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220371932.586:10): user pid=2197 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220371932.590:11): login pid=2197 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220371932.641:12): user pid=2197 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220371932.694:13): user pid=2197 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220371932.695:14): user pid=2197 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=AVC msg=audit(1220372003.615:15): avc:  denied  { write } for  pid=2419 comm="ccp" name="fifo0" dev=dm-0 ino=394171 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1220372003.615:15): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bfaab930 a1=81 a2=3f0 a3=bfaab930 items=0 ppid=1956 pid=2419 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1220372283.613:16): user pid=2197 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220372283.613:17): user pid=2197 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220372285.923:3982): auditd normal halt, sending auid=0 pid=2755 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220375924.159:1810): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1736 res=success
>type=CONFIG_CHANGE msg=audit(1220375924.268:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220375928.628:6): user pid=1941 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220375948.659:7): user pid=2166 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220375948.664:8): user pid=2166 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220375948.668:9): user pid=2166 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220375948.672:10): login pid=2166 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220375948.729:11): user pid=2166 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220375948.759:12): user pid=2166 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220375948.760:13): user pid=2166 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220376296.235:14): user pid=2461 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220376296.236:15): user pid=2461 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220376296.312:16): user pid=2461 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220376409.314:17): user pid=2489 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220376409.318:18): user pid=2489 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220376409.329:19): user pid=2489 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220376409.329:20): user pid=2489 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1220376580.417:21): user pid=2489 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220376580.418:22): user pid=2489 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220376588.338:23): user pid=2461 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220376828.972:24): user pid=2166 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220376828.972:25): user pid=2166 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220376831.329:1811): auditd normal halt, sending auid=0 pid=2669 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220376882.551:683): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1738 res=success
>type=CONFIG_CHANGE msg=audit(1220376882.631:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220376886.671:6): user pid=1941 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220376904.640:7): user pid=2167 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220376904.646:8): user pid=2167 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220376904.679:9): user pid=2167 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220376904.683:10): login pid=2167 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220376904.744:11): user pid=2167 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220376904.770:12): user pid=2167 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220376904.772:13): user pid=2167 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220377058.721:14): user pid=2418 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220377058.721:15): user pid=2418 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220377058.779:16): user pid=2418 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=LABEL_LEVEL_CHANGE msg=audit(1220377125.520:17): user pid=1941 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_END msg=audit(1220377132.951:18): user pid=2418 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220377142.679:19): user pid=2167 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220377142.679:20): user pid=2167 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220377144.947:684): auditd normal halt, sending auid=0 pid=2586 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220422350.951:2618): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1745 res=success
>type=CONFIG_CHANGE msg=audit(1220422351.035:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220422355.519:6): user pid=1950 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220422377.263:7): user pid=2177 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220422377.269:8): user pid=2177 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220422377.270:9): user pid=2177 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220422377.292:10): login pid=2177 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220422377.348:11): user pid=2177 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220422377.403:12): user pid=2177 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220422377.405:13): user pid=2177 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_END msg=audit(1220422793.573:14): user pid=2177 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220422793.574:15): user pid=2177 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220422795.937:2619): auditd normal halt, sending auid=0 pid=2667 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220450034.792:4169): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1745 res=success
>type=CONFIG_CHANGE msg=audit(1220450034.910:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220450038.762:6): user pid=1948 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220450061.910:7): user pid=2169 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220450061.916:8): user pid=2169 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220450061.918:9): user pid=2169 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220450061.927:10): login pid=2169 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220450061.979:11): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220450062.025:12): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220450062.027:13): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220450461.717:14): user pid=2389 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220450461.718:15): user pid=2389 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220450461.718:16): login pid=2389 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220450461.720:17): user pid=2389 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220450461.768:18): user pid=2389 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220450461.769:19): user pid=2389 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1220450717.352:20): user pid=2416 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220450717.355:21): user pid=2416 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220450717.399:22): user pid=2416 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220450717.399:23): user pid=2416 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=AVC msg=audit(1220450956.039:24): avc:  denied  { write } for  pid=2466 comm="ccp" name="fifo0" dev=dm-0 ino=394171 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1220450956.039:24): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bff09590 a1=81 a2=3f0 a3=bff09590 items=0 ppid=1948 pid=2466 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1220451867.617:25): user pid=2633 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220451867.617:26): user pid=2633 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220451867.656:27): user pid=2633 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=ANOM_ABEND msg=audit(1220453860.737:28): auid=500 uid=0 gid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 pid=2731 comm="ccpd" sig=11
>type=ANOM_ABEND msg=audit(1220453870.040:29): auid=500 uid=0 gid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 pid=2763 comm="ccpd" sig=11
>type=ANOM_ABEND msg=audit(1220453887.186:30): auid=500 uid=0 gid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 pid=2751 comm="ccpd" sig=11
>type=CRED_DISP msg=audit(1220453889.761:31): user pid=2416 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220453889.763:32): user pid=2416 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220453889.781:33): user pid=2633 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220453889.953:34): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220453889.954:35): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220453892.422:4170): auditd normal halt, sending auid=0 pid=2928 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220453968.759:1766): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1744 res=success
>type=CONFIG_CHANGE msg=audit(1220453968.839:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220453972.970:6): user pid=1947 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1220453973.583:7): avc:  denied  { write } for  pid=1955 comm="ccp" name="fifo0" dev=dm-0 ino=394171 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1220453973.583:7): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bf8bb740 a1=81 a2=3f0 a3=bf8bb740 items=0 ppid=1947 pid=1955 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1220453994.974:8): user pid=2181 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220453994.979:9): user pid=2181 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220453994.985:10): user pid=2181 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220453994.992:11): login pid=2181 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220453995.040:12): user pid=2181 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220453995.073:13): user pid=2181 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220453995.075:14): user pid=2181 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220454013.691:15): user pid=2401 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_ACCT msg=audit(1220454061.679:16): user pid=2447 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220454061.681:17): user pid=2447 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220454061.681:18): login pid=2447 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220454061.686:19): user pid=2447 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220454061.719:20): user pid=2447 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220454061.719:21): user pid=2447 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=AVC msg=audit(1220454129.580:22): avc:  denied  { write } for  pid=2476 comm="ccp" name="fifo0" dev=dm-0 ino=394171 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1220454129.580:22): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bfa75900 a1=81 a2=3f0 a3=bfa75900 items=0 ppid=1947 pid=2476 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1220454191.930:23): user pid=2501 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_ACCT msg=audit(1220454191.933:24): user pid=2501 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_START msg=audit(1220454192.000:25): user pid=2501 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=CRED_ACQ msg=audit(1220454192.000:26): user pid=2501 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=AVC msg=audit(1220454457.070:27): avc:  denied  { write } for  pid=2575 comm="ccp" name="fifo0" dev=dm-0 ino=394171 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1220454457.070:27): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bf8e2f70 a1=81 a2=3f0 a3=bf8e2f70 items=0 ppid=1947 pid=2575 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1220454554.769:28): user pid=2501 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_END msg=audit(1220454554.770:29): user pid=2501 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_END msg=audit(1220454613.555:30): user pid=2181 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220454613.556:31): user pid=2181 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220454616.062:1767): auditd normal halt, sending auid=0 pid=2747 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220454667.876:8330): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1740 res=success
>type=CONFIG_CHANGE msg=audit(1220454667.955:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220454671.828:6): user pid=1945 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=AVC msg=audit(1220454673.325:7): avc:  denied  { write } for  pid=1956 comm="ccp" name="fifo0" dev=dm-0 ino=394171 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1220454673.325:7): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bfe13490 a1=81 a2=3f0 a3=bfe13490 items=0 ppid=1945 pid=1956 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1220454691.756:8): user pid=2179 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220454691.760:9): user pid=2179 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220454691.778:10): user pid=2179 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220454691.787:11): login pid=2179 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220454691.841:12): user pid=2179 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220454691.866:13): user pid=2179 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220454691.867:14): user pid=2179 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220454797.684:15): user pid=2482 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220454797.706:16): user pid=2482 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220454797.745:17): user pid=2482 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220454797.745:18): user pid=2482 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=ANOM_ABEND msg=audit(1220454824.805:19): auid=500 uid=0 gid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 pid=2520 comm="ccpd" sig=11
>type=AVC msg=audit(1220454889.345:20): avc:  denied  { write } for  pid=2550 comm="ccp" name="fifo0" dev=dm-0 ino=394171 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1220454889.345:20): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bf9db060 a1=81 a2=3f0 a3=bf9db060 items=0 ppid=1945 pid=2550 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1220454952.130:21): user pid=2558 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=failed)'
>type=USER_AUTH msg=audit(1220454980.813:22): user pid=2564 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220454980.813:23): user pid=2564 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220454980.830:24): user pid=2564 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220455047.368:25): user pid=2564 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220455053.303:26): user pid=2590 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220455053.303:27): user pid=2590 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220455053.310:28): user pid=2590 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220455146.271:29): user pid=2590 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1220455492.032:30): user pid=2482 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220455492.032:31): user pid=2482 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=ANOM_ABEND msg=audit(1220455884.040:32): auid=500 uid=0 gid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 pid=2542 comm="ccpd" sig=11
>type=ANOM_ABEND msg=audit(1220457497.059:33): auid=500 uid=500 gid=500 ses=1 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 pid=2988 comm="xarchiver" sig=6
>type=USER_ACCT msg=audit(1220457661.637:34): user pid=3012 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220457661.638:35): user pid=3012 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220457661.638:36): login pid=3012 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220457661.640:37): user pid=3012 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220457661.672:38): user pid=3012 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220457661.672:39): user pid=3012 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1220460408.944:40): user pid=20288 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220460408.945:41): user pid=20288 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220460408.955:42): user pid=20288 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220460690.528:43): user pid=20288 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220460923.322:44): user pid=20380 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220460923.322:45): user pid=20380 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220460923.332:46): user pid=20380 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220461131.764:47): user pid=20380 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220461191.190:48): user pid=2179 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220461191.190:49): user pid=2179 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220461193.471:8331): auditd normal halt, sending auid=0 pid=20599 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220506920.184:6437): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1743 res=success
>type=CONFIG_CHANGE msg=audit(1220506920.270:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220506924.461:6): user pid=1948 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220506942.949:7): user pid=2173 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220506942.954:8): user pid=2173 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220506942.986:9): user pid=2173 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220506942.989:10): login pid=2173 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220506943.042:11): user pid=2173 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220506943.076:12): user pid=2173 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220506943.078:13): user pid=2173 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220507090.717:14): user pid=2395 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220507090.718:15): user pid=2395 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220507090.787:16): user pid=2395 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220507334.003:17): user pid=2426 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220507334.007:18): user pid=2426 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220507334.019:19): user pid=2426 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220507334.019:20): user pid=2426 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=ANOM_ABEND msg=audit(1220507349.972:21): auid=500 uid=0 gid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 pid=2464 comm="ccpd" sig=11
>type=USER_ACCT msg=audit(1220508061.200:22): user pid=2476 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220508061.202:23): user pid=2476 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220508061.203:24): login pid=2476 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220508061.205:25): user pid=2476 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220508061.235:26): user pid=2476 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220508061.236:27): user pid=2476 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220508448.542:28): user pid=2426 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220508448.544:29): user pid=2426 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1220508619.648:30): user pid=2539 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220508619.648:31): user pid=2539 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220508619.654:32): user pid=2539 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220508775.082:33): user pid=2539 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220508813.941:34): user pid=2395 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220508967.428:35): user pid=2173 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220508967.429:36): user pid=2173 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220508969.710:6438): auditd normal halt, sending auid=0 pid=2706 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220534508.967:3038): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1742 res=success
>type=CONFIG_CHANGE msg=audit(1220534509.064:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220534513.328:6): user pid=1947 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220534533.641:7): user pid=2168 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220534533.645:8): user pid=2168 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220534533.647:9): user pid=2168 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220534533.661:10): login pid=2168 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220534533.714:11): user pid=2168 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220534533.742:12): user pid=2168 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220534533.744:13): user pid=2168 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220535762.452:14): user pid=2518 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220535762.453:15): user pid=2518 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220535762.528:16): user pid=2518 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220536224.484:17): user pid=2547 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_ACCT msg=audit(1220536224.486:18): user pid=2547 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_START msg=audit(1220536224.494:19): user pid=2547 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=CRED_ACQ msg=audit(1220536224.495:20): user pid=2547 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_ACCT msg=audit(1220536861.913:21): user pid=2585 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220536861.914:22): user pid=2585 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220536861.915:23): login pid=2585 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220536861.917:24): user pid=2585 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220536861.956:25): user pid=2585 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220536861.956:26): user pid=2585 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220537080.087:27): user pid=2547 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_END msg=audit(1220537080.088:28): user pid=2547 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_END msg=audit(1220537084.811:29): user pid=2518 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220537215.044:30): user pid=2168 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220537215.044:31): user pid=2168 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220537217.251:3039): auditd normal halt, sending auid=0 pid=2756 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220541588.101:5333): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1744 res=success
>type=CONFIG_CHANGE msg=audit(1220541588.198:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220541592.328:6): user pid=1949 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220541618.549:7): user pid=2169 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="?" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=failed)'
>type=USER_LOGIN msg=audit(1220541618.550:8): user pid=2169 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='acct=unknown: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=failed)'
>type=USER_AUTH msg=audit(1220541628.597:9): user pid=2169 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220541628.602:10): user pid=2169 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220541628.612:11): user pid=2169 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220541628.615:12): login pid=2169 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220541628.664:13): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220541628.702:14): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220541628.703:15): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_END msg=audit(1220543009.315:16): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220543009.316:17): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220543011.537:5334): auditd normal halt, sending auid=0 pid=2590 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220593827.276:8283): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1736 res=success
>type=CONFIG_CHANGE msg=audit(1220593827.394:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220593831.611:6): user pid=1943 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220593869.933:7): user pid=2164 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220593869.938:8): user pid=2164 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220593869.939:9): user pid=2164 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220593869.952:10): login pid=2164 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220593870.004:11): user pid=2164 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220593870.032:12): user pid=2164 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220593870.034:13): user pid=2164 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220594461.288:14): user pid=2450 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220594461.289:15): user pid=2450 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220594461.290:16): login pid=2450 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220594461.293:17): user pid=2450 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220594461.330:18): user pid=2450 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220594461.331:19): user pid=2450 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220595192.152:20): user pid=2164 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220595192.153:21): user pid=2164 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220595194.446:8284): auditd normal halt, sending auid=0 pid=2685 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220615447.400:4929): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1743 res=success
>type=CONFIG_CHANGE msg=audit(1220615447.505:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220615451.669:6): user pid=1948 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220615469.868:7): user pid=2163 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220615469.874:8): user pid=2163 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220615469.886:9): user pid=2163 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220615469.889:10): login pid=2163 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220615469.939:11): user pid=2163 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220615469.984:12): user pid=2163 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220615469.986:13): user pid=2163 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220616061.263:14): user pid=2471 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220616061.264:15): user pid=2471 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220616061.265:16): login pid=2471 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220616061.266:17): user pid=2471 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220616061.298:18): user pid=2471 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220616061.298:19): user pid=2471 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1220616304.350:20): user pid=2509 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220616304.354:21): user pid=2509 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220616304.402:22): user pid=2509 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220616304.402:23): user pid=2509 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1220616769.650:24): user pid=2509 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220616769.650:25): user pid=2509 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220619661.314:26): user pid=2826 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220619661.315:27): user pid=2826 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220619661.315:28): login pid=2826 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1220619661.316:29): user pid=2826 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220619661.321:30): user pid=2826 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220619661.322:31): user pid=2826 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1220620935.839:32): user pid=3168 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220620935.839:33): user pid=3168 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220620935.868:34): user pid=3168 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220622276.032:35): user pid=2163 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220622276.035:36): user pid=2163 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1220622276.082:37): user pid=3168 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=DAEMON_END msg=audit(1220622278.335:4930): auditd normal halt, sending auid=0 pid=4862 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220630330.117:578): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1739 res=success
>type=CONFIG_CHANGE msg=audit(1220630330.220:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220630334.286:6): user pid=1946 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220630353.543:7): user pid=2186 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220630353.549:8): user pid=2186 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220630353.561:9): user pid=2186 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220630353.565:10): login pid=2186 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220630353.629:11): user pid=2186 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220630353.658:12): user pid=2186 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220630353.660:13): user pid=2186 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220630461.907:14): user pid=2422 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220630461.908:15): user pid=2422 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220630461.909:16): login pid=2422 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220630461.911:17): user pid=2422 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220630461.941:18): user pid=2422 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220630461.942:19): user pid=2422 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1220631001.311:20): user pid=2508 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220631001.311:21): user pid=2508 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220631001.384:22): user pid=2508 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220632231.429:23): user pid=2186 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220632231.429:24): user pid=2186 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1220632231.456:25): user pid=2508 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=DAEMON_END msg=audit(1220632233.632:579): auditd normal halt, sending auid=0 pid=3258 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220683207.250:2606): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1740 res=success
>type=CONFIG_CHANGE msg=audit(1220683207.370:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220683211.661:6): user pid=1945 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220683231.288:7): user pid=2159 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220683231.294:8): user pid=2159 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220683231.302:9): user pid=2159 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220683231.305:10): login pid=2159 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220683231.371:11): user pid=2159 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220683231.417:12): user pid=2159 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220683231.418:13): user pid=2159 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220684461.426:14): user pid=2542 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220684461.429:15): user pid=2542 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220684461.429:16): login pid=2542 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220684461.431:17): user pid=2542 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220684461.470:18): user pid=2542 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220684461.470:19): user pid=2542 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1220684480.260:20): user pid=2547 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220684480.260:21): user pid=2547 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220684480.366:22): user pid=2547 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220684512.501:23): user pid=2547 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220684521.546:24): user pid=2563 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220684521.546:25): user pid=2563 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220684521.556:26): user pid=2563 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220684961.294:27): user pid=2563 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220685045.934:28): user pid=2605 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220685045.938:29): user pid=2605 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220685045.949:30): user pid=2605 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220685045.949:31): user pid=2605 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1220685400.090:32): user pid=2669 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220685400.090:33): user pid=2669 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220685400.096:34): user pid=2669 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1220687046.108:35): user pid=2605 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220687046.109:36): user pid=2605 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1220687227.304:37): user pid=2763 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220687227.308:38): user pid=2763 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220687227.319:39): user pid=2763 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220687227.320:40): user pid=2763 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1220687301.499:41): user pid=2763 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220687301.500:42): user pid=2763 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220687344.300:43): user pid=2669 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=AVC msg=audit(1220687503.011:44): avc:  denied  { write } for  pid=2822 comm="ccp" name="fifo0" dev=dm-0 ino=394171 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1220687503.011:44): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bfc23ab0 a1=81 a2=3f0 a3=bfc23ab0 items=0 ppid=1945 pid=2822 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1220687544.661:45): user pid=2852 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220687544.664:46): user pid=2852 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220687544.671:47): user pid=2852 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220687544.671:48): user pid=2852 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=AVC msg=audit(1220687585.678:49): avc:  denied  { write } for  pid=2885 comm="ccp" name="fifo0" dev=dm-0 ino=394171 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_t:s0 tclass=fifo_file
>type=SYSCALL msg=audit(1220687585.678:49): arch=40000003 syscall=5 per=400000 success=no exit=-13 a0=bffd6660 a1=81 a2=3f0 a3=bffd6660 items=0 ppid=1945 pid=2885 auid=4294967295 uid=4 gid=7 euid=4 suid=4 fsuid=4 egid=7 sgid=7 fsgid=7 tty=(none) ses=4294967295 comm="ccp" exe="/usr/lib/cups/backend/ccp" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1220687725.832:50): user pid=2852 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220687725.832:51): user pid=2852 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220687736.172:52): user pid=2159 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220687736.172:53): user pid=2159 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220687738.492:2607): auditd normal halt, sending auid=0 pid=6757 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220692206.959:5184): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1741 res=success
>type=CONFIG_CHANGE msg=audit(1220692207.055:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220692211.111:6): user pid=1946 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220692229.184:7): user pid=2170 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220692229.190:8): user pid=2170 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220692229.194:9): user pid=2170 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220692229.198:10): login pid=2170 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220692229.256:11): user pid=2170 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220692229.284:12): user pid=2170 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220692229.286:13): user pid=2170 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220692298.096:14): user pid=2391 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220692298.098:15): user pid=2391 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220692298.173:16): user pid=2391 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1220692680.555:17): user pid=2400 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct="apache" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1220692684.517:18): user pid=2408 uid=0 auid=500 subj=system_u:system_r:groupadd_t:s0 msg='op=adding group acct="wbpriv" exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1220692703.593:19): user pid=2433 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user acct="backuppc" exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AVC msg=audit(1220692715.258:20): user pid=1757 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=MAC_POLICY_LOAD msg=audit(1220692714.608:21): policy loaded auid=500 ses=1
>type=SYSCALL msg=audit(1220692714.608:21): arch=40000003 syscall=4 success=yes exit=4141914 a0=4 a1=b7bcc000 a2=3f335a a3=bfecc948 items=0 ppid=2439 pid=2440 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="load_policy" exe="/usr/sbin/load_policy" subj=system_u:system_r:load_policy_t:s0 key=(null)
>type=USER_CHAUTHTOK msg=audit(1220692716.686:22): user pid=2481 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user to group acct="apache" exe="/usr/sbin/usermod" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_CHAUTHTOK msg=audit(1220692716.699:23): user pid=2481 uid=0 auid=500 subj=system_u:system_r:useradd_t:s0 msg='op=adding user to shadow group acct="apache" exe="/usr/sbin/usermod" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220693121.982:24): user pid=2517 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220693121.985:25): user pid=2517 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220693121.996:26): user pid=2517 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220693121.996:27): user pid=2517 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1220693175.167:28): user pid=2538 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220693175.167:29): user pid=2538 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220693175.179:30): user pid=2538 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220693195.703:31): user pid=2538 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=CRED_DISP msg=audit(1220694401.208:32): user pid=2517 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220694401.208:33): user pid=2517 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220694401.278:34): user pid=2170 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220694401.280:35): user pid=2170 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_END msg=audit(1220694401.311:36): user pid=2391 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=DAEMON_END msg=audit(1220694403.542:5185): auditd normal halt, sending auid=0 pid=2734 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220694454.975:4737): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1742 res=success
>type=CONFIG_CHANGE msg=audit(1220694455.086:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220694459.292:6): user pid=1948 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220694477.719:7): user pid=2169 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220694477.724:8): user pid=2169 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220694477.736:9): user pid=2169 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220694477.739:10): login pid=2169 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220694477.807:11): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220694477.851:12): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220694477.852:13): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_END msg=audit(1220695180.462:14): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220695180.463:15): user pid=2169 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220695182.619:4738): auditd normal halt, sending auid=0 pid=2587 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220698530.925:3530): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1743 res=success
>type=CONFIG_CHANGE msg=audit(1220698531.028:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220698535.103:6): user pid=1946 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220698551.672:7): user pid=2178 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220698551.677:8): user pid=2178 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220698551.688:9): user pid=2178 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220698551.712:10): login pid=2178 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220698551.762:11): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220698551.794:12): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220698551.797:13): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220698582.455:14): user pid=2425 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220698582.458:15): user pid=2425 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220698582.515:16): user pid=2425 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220698582.516:17): user pid=2425 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=ANOM_ABEND msg=audit(1220698599.478:18): auid=500 uid=0 gid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 pid=2463 comm="ccpd" sig=11
>type=CRED_DISP msg=audit(1220698617.130:19): user pid=2425 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220698617.131:20): user pid=2425 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220698861.664:21): user pid=2526 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220698861.665:22): user pid=2526 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220698861.665:23): login pid=2526 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220698861.667:24): user pid=2526 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220698861.698:25): user pid=2526 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220698861.699:26): user pid=2526 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1220698995.191:27): user pid=2541 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220698995.191:28): user pid=2541 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220698995.217:29): user pid=2541 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220699850.312:30): user pid=2541 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220700348.648:31): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220700348.649:32): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220700350.934:3531): auditd normal halt, sending auid=0 pid=2900 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220700402.059:8485): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1737 res=success
>type=CONFIG_CHANGE msg=audit(1220700402.155:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220700406.303:6): user pid=1942 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220700429.686:7): user pid=2183 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220700429.689:8): user pid=2183 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220700429.718:9): user pid=2183 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220700429.722:10): login pid=2183 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220700429.780:11): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220700429.825:12): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220700429.826:13): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220700467.247:14): user pid=2401 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220700467.247:15): user pid=2401 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220700467.355:16): user pid=2401 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220700515.019:17): user pid=2401 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220701419.659:18): user pid=2644 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220701419.663:19): user pid=2644 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220701419.677:20): user pid=2644 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220701419.678:21): user pid=2644 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1220701437.536:22): user pid=2644 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220701437.536:23): user pid=2644 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1220701469.237:24): user pid=2665 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220701469.237:25): user pid=2665 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220701469.245:26): user pid=2665 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AVC msg=audit(1220701557.474:27): user pid=1753 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=MAC_POLICY_LOAD msg=audit(1220701556.831:28): policy loaded auid=500 ses=1
>type=SYSCALL msg=audit(1220701556.831:28): arch=40000003 syscall=4 success=yes exit=4141854 a0=4 a1=b7b6c000 a2=3f331e a3=bfe6c868 items=0 ppid=2704 pid=2705 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="load_policy" exe="/usr/sbin/load_policy" subj=system_u:system_r:load_policy_t:s0 key=(null)
>type=USER_END msg=audit(1220701692.496:29): user pid=2665 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220701825.965:30): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220701825.965:31): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220701828.125:8486): auditd normal halt, sending auid=0 pid=2864 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220701877.842:6049): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1741 res=success
>type=CONFIG_CHANGE msg=audit(1220701877.953:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220701882.036:6): user pid=1946 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220701906.333:7): user pid=2176 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220701906.338:8): user pid=2176 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220701906.339:9): user pid=2176 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220701906.350:10): login pid=2176 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220701906.403:11): user pid=2176 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220701906.429:12): user pid=2176 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220701906.431:13): user pid=2176 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220701961.323:14): user pid=2398 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220701961.323:15): user pid=2398 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220701961.385:16): user pid=2398 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220702019.088:17): user pid=2398 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220702031.192:18): user pid=2176 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220702031.192:19): user pid=2176 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220702032.511:6050): auditd normal halt, sending auid=0 pid=2586 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220702097.900:3956): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1745 res=success
>type=CONFIG_CHANGE msg=audit(1220702098.003:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220702102.070:6): user pid=1950 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220702118.813:7): user pid=2183 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220702118.820:8): user pid=2183 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220702118.828:9): user pid=2183 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220702118.831:10): login pid=2183 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220702118.883:11): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220702118.927:12): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220702118.929:13): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_END msg=audit(1220702136.752:14): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220702136.753:15): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220702138.957:3957): auditd normal halt, sending auid=0 pid=2551 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220721956.067:8036): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1742 res=success
>type=CONFIG_CHANGE msg=audit(1220721956.163:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220721960.503:6): user pid=1949 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220721981.674:7): user pid=2183 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220721981.681:8): user pid=2183 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220721981.693:9): user pid=2183 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220721981.697:10): login pid=2183 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220721981.757:11): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220721981.825:12): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220721981.827:13): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220722010.985:14): user pid=2402 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220722010.985:15): user pid=2402 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220722011.051:16): user pid=2402 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220723330.621:17): user pid=3559 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220723330.622:18): user pid=3559 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220723330.631:19): user pid=3559 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220723348.858:20): user pid=3559 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220723694.585:21): user pid=2402 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220723862.963:22): user pid=3629 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220723862.964:23): user pid=3629 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220723862.974:24): user pid=3629 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220723885.669:25): user pid=3629 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220723991.136:26): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220723991.137:27): user pid=2183 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220723993.420:8037): auditd normal halt, sending auid=0 pid=3798 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220778147.942:4344): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1740 res=success
>type=CONFIG_CHANGE msg=audit(1220778148.043:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220778152.320:6): user pid=1945 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220778169.842:7): user pid=2178 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220778169.847:8): user pid=2178 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220778169.853:9): user pid=2178 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220778169.862:10): login pid=2178 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220778169.916:11): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220778169.959:12): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220778169.960:13): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220779234.852:14): user pid=2106 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_ACCT msg=audit(1220779234.855:15): user pid=2106 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=LOGIN msg=audit(1220779234.856:16): login pid=2106 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2
>type=USER_ROLE_CHANGE msg=audit(1220779234.869:17): user pid=2106 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_START msg=audit(1220779234.879:18): user pid=2106 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=CRED_ACQ msg=audit(1220779234.879:19): user pid=2106 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_LOGIN msg=audit(1220779234.879:20): user pid=2106 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login acct="mrtn" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=CRED_DISP msg=audit(1220779704.593:21): user pid=2106 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_END msg=audit(1220779704.595:22): user pid=2106 uid=0 auid=500 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
>type=USER_END msg=audit(1220779707.981:23): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220779707.982:24): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220779710.380:4345): auditd normal halt, sending auid=0 pid=2610 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220779775.017:6001): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1743 res=success
>type=CONFIG_CHANGE msg=audit(1220779775.135:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220779779.294:6): user pid=1948 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220779804.861:7): user pid=2180 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220779804.865:8): user pid=2180 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220779804.866:9): user pid=2180 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220779804.874:10): login pid=2180 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220779804.937:11): user pid=2180 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220779804.980:12): user pid=2180 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220779804.981:13): user pid=2180 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220781662.025:14): user pid=2604 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220781662.026:15): user pid=2604 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220781662.026:16): login pid=2604 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220781662.029:17): user pid=2604 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220781662.059:18): user pid=2604 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220781662.060:19): user pid=2604 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1220782459.418:20): user pid=2618 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220782459.418:21): user pid=2618 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220782459.479:22): user pid=2618 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220785261.078:23): user pid=4218 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220785261.080:24): user pid=4218 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220785261.081:25): login pid=4218 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1220785261.083:26): user pid=4218 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220785261.095:27): user pid=4218 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220785261.095:28): user pid=4218 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220787540.184:29): user pid=2618 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220787610.883:30): user pid=4294 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220787610.887:31): user pid=4294 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220787610.899:32): user pid=4294 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220787610.900:33): user pid=4294 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1220787787.054:34): user pid=4294 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220787787.054:35): user pid=4294 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220788148.353:36): user pid=2180 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220788148.354:37): user pid=2180 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220788150.631:6002): auditd normal halt, sending auid=0 pid=4530 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220788201.959:3330): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1736 res=success
>type=CONFIG_CHANGE msg=audit(1220788202.071:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220788206.636:6): user pid=1943 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220788230.638:7): user pid=2173 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220788230.643:8): user pid=2173 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220788230.645:9): user pid=2173 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220788230.649:10): login pid=2173 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220788230.715:11): user pid=2173 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220788230.758:12): user pid=2173 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220788230.759:13): user pid=2173 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220788861.100:14): user pid=2394 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220788861.102:15): user pid=2394 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220788861.103:16): login pid=2394 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220788861.106:17): user pid=2394 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220788861.143:18): user pid=2394 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220788861.144:19): user pid=2394 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1220789510.583:20): user pid=2431 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220789510.587:21): user pid=2431 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220789510.647:22): user pid=2431 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220789510.648:23): user pid=2431 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1220789565.930:24): user pid=2431 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220789565.931:25): user pid=2431 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1220790655.795:26): user pid=2493 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220790655.799:27): user pid=2493 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220790655.805:28): user pid=2493 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220790655.806:29): user pid=2493 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1220791129.208:30): user pid=2493 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220791129.209:31): user pid=2493 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1220791263.302:32): user pid=2173 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220791263.302:33): user pid=2173 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220791265.481:3331): auditd normal halt, sending auid=0 pid=2723 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220797916.105:4680): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1743 res=success
>type=CONFIG_CHANGE msg=audit(1220797916.228:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220797920.527:6): user pid=1948 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220797948.434:7): user pid=2178 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220797948.439:8): user pid=2178 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220797948.440:9): user pid=2178 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220797948.498:10): login pid=2178 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220797948.559:11): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220797948.596:12): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220797948.597:13): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220797987.323:14): user pid=2396 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220797987.323:15): user pid=2396 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220797987.399:16): user pid=2396 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220798129.863:17): user pid=2396 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220798710.722:18): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220798710.722:19): user pid=2178 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220798713.034:4681): auditd normal halt, sending auid=0 pid=2568 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220806718.925:1416): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1739 res=success
>type=CONFIG_CHANGE msg=audit(1220806719.021:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220806723.126:6): user pid=1946 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220806742.322:7): user pid=2179 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220806742.325:8): user pid=2179 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220806742.336:9): user pid=2179 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220806742.339:10): login pid=2179 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220806742.398:11): user pid=2179 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220806742.435:12): user pid=2179 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220806742.436:13): user pid=2179 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220806813.433:14): user pid=2412 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220806813.434:15): user pid=2412 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220806813.497:16): user pid=2412 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_ACCT msg=audit(1220806861.733:17): user pid=2418 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1220806861.735:18): user pid=2418 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1220806861.736:19): login pid=2418 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1220806861.740:20): user pid=2418 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1220806861.776:21): user pid=2418 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220806861.777:22): user pid=2418 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1220808015.755:23): user pid=2412 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/userhelper" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_END msg=audit(1220808160.286:24): user pid=2179 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1220808160.286:25): user pid=2179 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1220808162.568:1417): auditd normal halt, sending auid=0 pid=2656 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1220881056.074:2613): auditd start, ver=1.7.4 format=raw kernel=2.6.25.14-69.fc8 auid=4294967295 pid=1742 res=success
>type=CONFIG_CHANGE msg=audit(1220881056.195:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=LABEL_LEVEL_CHANGE msg=audit(1220881060.528:6): user pid=1949 uid=0 auid=4294967295 subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 msg='printer=LBP2900 uri=ccp:/var/ccpd/fifo0 banners=none,none range=unknown: exe="/usr/sbin/cupsd" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=? res=success)'
>type=USER_AUTH msg=audit(1220881126.786:7): user pid=2184 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1220881126.790:8): user pid=2184 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1220881126.791:9): user pid=2184 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1220881126.807:10): login pid=2184 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1220881126.860:11): user pid=2184 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=? res=success)'
>type=USER_START msg=audit(1220881126.905:12): user pid=2184 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="mrtn" exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1220881126.907:13): user pid=2184 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=localhost.localdomain, addr=127.0.0.1, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1220881564.565:14): user pid=2514 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1220881564.569:15): user pid=2514 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1220881564.611:16): user pid=2514 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1220881564.612:17): user pid=2514 uid=500 auid=500 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'

Actions: View | Diff

Attachments on bug 461346: 315946 | 315947 | 315948 | 316087