Attachment 317085 Details for Bug 462702 – /var/log/audit/audit.log

/var/log/audit/audit.log

audit.log (text/plain), 155.30 KB, created by Richard W.M. Jones on 2008-09-18 14:18:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Richard W.M. Jones

Created: 2008-09-18 14:18:11 UTC

Size: 155.30 KB

patch

obsolete

>type=DAEMON_START msg=audit(1211544397.863:8599): auditd start, ver=1.6.5 format=raw kernel=2.6.18-92.el5 auid=4294967295 pid=5901 res=success
>type=CONFIG_CHANGE msg=audit(1211544397.964:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1211544397.969:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USYS_CONFIG msg=audit(1211545810.999:6): user pid=6630 uid=0 auid=4294967295 subj=system_u:system_r:firstboot_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=pts/0 res=success)'
>type=USER_AUTH msg=audit(1211545856.433:7): user pid=6764 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_ACCT msg=audit(1211545856.434:8): user pid=6764 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_ACQ msg=audit(1211545856.434:9): user pid=6764 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=LOGIN msg=audit(1211545856.443:10): login pid=6764 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_START msg=audit(1211545856.450:11): user pid=6764 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=USER_LOGIN msg=audit(1211545856.451:12): user pid=6764 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=intel-mb, addr=192.168.2.134, terminal=:0 res=success)'
>type=USER_AUTH msg=audit(1211545919.864:13): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1211545919.864:14): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1211545919.902:15): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1211545919.903:16): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1211546305.869:17): user pid=7835 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=failed)'
>type=USER_AUTH msg=audit(1211546308.271:18): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_ACCT msg=audit(1211546308.271:19): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_START msg=audit(1211546308.276:20): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=CRED_ACQ msg=audit(1211546308.276:21): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=AVC msg=audit(1211546441.092:22): avc:  denied  { associate } for  pid=7864 comm="cp" name="grub.conf" scontext=user_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem
>type=SYSCALL msg=audit(1211546441.092:22): arch=40000003 syscall=5 success=no exit=-13 a0=bfca3a2d a1=8041 a2=8180 a3=8041 items=0 ppid=7042 pid=7864 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="cp" exe="/bin/cp" subj=user_u:system_r:unconfined_t:s0 key=(null)
>type=AVC msg=audit(1211546460.435:23): avc:  denied  { associate } for  pid=7872 comm="cp" name="grub.conf" scontext=user_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem
>type=SYSCALL msg=audit(1211546460.435:23): arch=40000003 syscall=5 success=no exit=-13 a0=bfb65a2d a1=8041 a2=8180 a3=8041 items=0 ppid=7042 pid=7872 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="cp" exe="/bin/cp" subj=user_u:system_r:unconfined_t:s0 key=(null)
>type=CRED_DISP msg=audit(1211546487.876:24): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1211546487.876:25): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1211546487.878:26): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_END msg=audit(1211546487.878:27): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_END msg=audit(1211546487.934:28): user pid=6764 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=CRED_DISP msg=audit(1211546487.935:29): user pid=6764 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)'
>type=DAEMON_END msg=audit(1211546491.817:8600): auditd normal halt, sending auid=4294967295 pid=8393 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1211546578.528:2837): auditd start, ver=1.6.5 format=raw kernel=2.6.18-92.el5xen auid=4294967295 pid=5895 res=success
>type=CONFIG_CHANGE msg=audit(1211546578.628:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1211546578.640:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_LOGIN msg=audit(1211546764.992:6): user pid=6771 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1211546767.640:7): user pid=6771 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1211546767.644:8): user pid=6771 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1211546767.688:9): user pid=6771 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1211546767.696:10): login pid=6771 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_START msg=audit(1211546767.696:11): user pid=6771 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1211546767.700:12): user pid=6774 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1211546767.788:13): user pid=6771 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)'
>type=CRED_DISP msg=audit(1211546805.734:14): user pid=6771 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1211546805.738:15): user pid=6771 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1211546807.058:16): user pid=6812 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1211546807.102:17): user pid=6812 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1211546807.102:18): login pid=6812 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1211546807.106:19): user pid=6812 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1211546807.106:20): user pid=6814 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1211546807.114:21): user pid=6812 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)'
>type=USER_AUTH msg=audit(1211546842.032:22): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1211546842.032:23): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1211546842.052:24): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1211546842.052:25): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=ANOM_PROMISCUOUS msg=audit(1211547120.482:26): dev=vif0.1 prom=256 old_prom=0 auid=500 ses=2
>type=SYSCALL msg=audit(1211547120.482:26): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfbc14a0 a3=1 items=0 ppid=7042 pid=7353 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="brctl" exe="/usr/sbin/brctl" subj=user_u:system_r:xend_t:s0 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1211547123.582:27): dev=peth1 prom=256 old_prom=0 auid=500 ses=2
>type=SYSCALL msg=audit(1211547123.582:27): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfc1b500 a3=1 items=0 ppid=7042 pid=7368 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="brctl" exe="/usr/sbin/brctl" subj=user_u:system_r:xend_t:s0 key=(null)
>type=USER_ACCT msg=audit(1211547195.514:28): user pid=7560 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1211547195.558:29): user pid=7560 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1211547195.558:30): login pid=7560 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1211547195.558:31): user pid=7560 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1211547195.558:32): user pid=7562 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1211547195.566:33): user pid=7560 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/2 res=success)'
>type=USER_AUTH msg=audit(1211547208.703:34): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_ACCT msg=audit(1211547208.707:35): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_START msg=audit(1211547208.719:36): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=CRED_ACQ msg=audit(1211547208.719:37): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=ANOM_PROMISCUOUS msg=audit(1211547359.385:38): dev=vif1.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1211547359.385:38): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfef8b30 a3=1 items=0 ppid=7691 pid=7753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null)
>type=USER_ACCT msg=audit(1211547661.844:39): user pid=7908 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1211547661.844:40): user pid=7908 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1211547661.844:41): login pid=7908 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1211547661.868:42): user pid=7908 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1211547661.904:43): user pid=7908 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1211547661.904:44): user pid=7908 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=ANOM_PROMISCUOUS msg=audit(1211548181.648:45): dev=vif1.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295
>type=ANOM_PROMISCUOUS msg=audit(1211548217.910:46): dev=vif2.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1211548217.910:46): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfb66fa0 a3=1 items=0 ppid=8290 pid=8341 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1211548277.546:47): dev=vif2.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295
>type=ANOM_PROMISCUOUS msg=audit(1211548358.059:48): dev=vif3.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1211548358.059:48): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf9bd5f0 a3=1 items=0 ppid=8643 pid=8685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1211548442.704:49): dev=vif3.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295
>type=CRED_DISP msg=audit(1211549130.275:50): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_END msg=audit(1211549130.275:51): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=CRED_DISP msg=audit(1211549130.823:52): user pid=7560 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1211549130.827:53): user pid=7560 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1211549138.616:54): user pid=8925 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1211549138.660:55): user pid=8925 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1211549138.660:56): login pid=8925 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1211549138.660:57): user pid=8925 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1211549138.664:58): user pid=8927 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1211549138.672:59): user pid=8925 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/2 res=success)'
>type=USER_AUTH msg=audit(1211549140.892:60): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_ACCT msg=audit(1211549140.892:61): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_START msg=audit(1211549140.904:62): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=CRED_ACQ msg=audit(1211549140.904:63): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=ANOM_PROMISCUOUS msg=audit(1211549181.707:64): dev=vif4.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1211549181.707:64): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfb1c750 a3=1 items=0 ppid=9065 pid=9120 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1211549636.031:65): dev=vif4.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295
>type=ANOM_PROMISCUOUS msg=audit(1211549657.068:66): dev=vif6.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1211549657.068:66): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bffef420 a3=1 items=0 ppid=9503 pid=9586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null)
>type=USER_ACCT msg=audit(1211551261.189:67): user pid=31753 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1211551261.189:68): user pid=31753 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1211551261.189:69): login pid=31753 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_START msg=audit(1211551261.205:70): user pid=31753 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1211551261.233:71): user pid=31753 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1211551261.233:72): user pid=31753 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=ANOM_PROMISCUOUS msg=audit(1211551848.573:73): dev=vif6.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295
>type=ANOM_PROMISCUOUS msg=audit(1211551850.505:74): dev=vif7.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1211551850.505:74): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf926d60 a3=1 items=0 ppid=32157 pid=32199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1211552595.860:75): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1211552595.860:76): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1211552596.268:77): user pid=6812 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1211552596.268:78): user pid=6812 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1211552600.360:79): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=USER_END msg=audit(1211552600.364:80): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)'
>type=CRED_DISP msg=audit(1211552600.588:81): user pid=8925 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1211552600.588:82): user pid=8925 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1211553427.924:83): user pid=32619 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1211553428.012:84): user pid=32619 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1211553428.016:85): login pid=32619 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=7
>type=USER_START msg=audit(1211553428.016:86): user pid=32619 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1211553428.016:87): user pid=32621 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1211553428.048:88): user pid=32619 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)'
>type=CRED_DISP msg=audit(1211553429.292:89): user pid=32619 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1211553429.292:90): user pid=32619 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1211553434.336:91): user pid=32652 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1211553434.376:92): user pid=32652 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1211553434.376:93): login pid=32652 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=8
>type=USER_START msg=audit(1211553434.380:94): user pid=32652 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1211553434.380:95): user pid=32654 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1211553434.388:96): user pid=32652 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)'
>type=USER_AUTH msg=audit(1211553436.225:97): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1211553436.225:98): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1211553436.233:99): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1211553436.233:100): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1211553452.170:101): user pid=32652 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1211553452.174:102): user pid=32652 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1211553452.178:103): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1211553452.178:104): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1211553485.876:105): user pid=32709 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1211553485.916:106): user pid=32709 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1211553485.916:107): login pid=32709 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=9
>type=USER_START msg=audit(1211553485.916:108): user pid=32709 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1211553485.916:109): user pid=32711 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1211553485.924:110): user pid=32709 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)'
>type=USER_AUTH msg=audit(1211553489.200:111): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1211553489.204:112): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1211553489.236:113): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1211553489.236:114): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=ANOM_PROMISCUOUS msg=audit(1211553520.606:115): dev=vif7.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295
>type=CRED_DISP msg=audit(1211553567.901:116): user pid=32709 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1211553567.901:117): user pid=32709 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1211553567.905:118): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1211553567.905:119): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=DAEMON_END msg=audit(1211553572.796:2838): auditd normal halt, sending auid=4294967295 pid=1031 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1221481475.145:892): auditd start, ver=1.6.5 format=raw kernel=2.6.18-92.el5xen auid=4294967295 pid=5049 res=success
>type=CONFIG_CHANGE msg=audit(1221481475.243:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1221481475.251:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_PROMISCUOUS msg=audit(1221481522.614:6): dev=vif0.1 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1221481522.614:6): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfb807b0 a3=1 items=0 ppid=5954 pid=6142 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1221481525.730:7): dev=peth1 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1221481525.730:7): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bffda410 a3=1 items=0 ppid=5954 pid=6157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null)
>type=USER_AUTH msg=audit(1221481542.323:8): user pid=6521 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct="?" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=failed)'
>type=USER_LOGIN msg=audit(1221481542.323:9): user pid=6521 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='acct=rujo: exe="/usr/sbin/gdm-binary" (hostname=intel-mb, addr=192.168.2.134, terminal=:0 res=failed)'
>type=USER_AUTH msg=audit(1221481547.391:10): user pid=6417 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_ACCT msg=audit(1221481547.391:11): user pid=6417 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=LOGIN msg=audit(1221481547.415:12): login pid=6417 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1221481547.455:13): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=root:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=root:system_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_START msg=audit(1221481547.455:14): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_ACQ msg=audit(1221481547.455:15): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1221481547.455:16): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_LOGIN msg=audit(1221481597.854:17): user pid=6618 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1221481600.238:18): user pid=6618 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221481600.238:19): user pid=6618 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1221481600.279:20): user pid=6618 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1221481600.283:21): login pid=6618 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1221481600.283:22): user pid=6618 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1221481600.283:23): user pid=6620 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1221481600.287:24): user pid=6618 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)'
>type=USER_AUTH msg=audit(1221481605.355:25): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221481605.355:26): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1221481605.363:27): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1221481605.363:28): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_LOGIN msg=audit(1221482839.436:29): user pid=6706 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1221482841.200:30): user pid=6706 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221482841.200:31): user pid=6706 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1221482841.240:32): user pid=6706 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1221482841.240:33): login pid=6706 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1221482841.240:34): user pid=6706 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1221482841.244:35): user pid=6708 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1221482842.176:36): user pid=6706 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1221482842.180:37): user pid=6706 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221483661.495:38): user pid=6794 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221483661.495:39): user pid=6794 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221483661.495:40): login pid=6794 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1221483661.523:41): user pid=6794 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221483661.563:42): user pid=6794 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221483661.563:43): user pid=6794 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_LOGIN msg=audit(1221484621.419:44): user pid=6856 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1221484623.515:45): user pid=6856 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221484623.519:46): user pid=6856 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1221484623.559:47): user pid=6856 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1221484623.559:48): login pid=6856 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1221484623.559:49): user pid=6856 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1221484623.563:50): user pid=6858 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1221484625.372:51): user pid=6856 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1221484625.372:52): user pid=6856 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1221485016.248:53): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=USER_END msg=audit(1221485016.248:54): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)'
>type=CRED_DISP msg=audit(1221485019.232:55): user pid=6618 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1221485019.232:56): user pid=6618 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1221485019.236:57): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1221485019.236:58): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=DAEMON_END msg=audit(1221485020.820:893): auditd normal halt, sending auid=4294967295 pid=8811 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1221485159.103:7301): auditd start, ver=1.6.5 format=raw kernel=2.6.18-115.el5xen auid=4294967295 pid=5038 res=success
>type=CONFIG_CHANGE msg=audit(1221485159.199:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1221485159.207:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_PROMISCUOUS msg=audit(1221485177.965:6): dev=vif0.1 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1221485177.965:6): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf94bd80 a3=1 items=0 ppid=6002 pid=6190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1221485181.145:7): dev=peth1 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1221485181.145:7): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf9dde10 a3=1 items=0 ppid=6002 pid=6205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null)
>type=USER_LOGIN msg=audit(1221485208.458:8): user pid=6627 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1221485210.715:9): user pid=6627 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221485210.715:10): user pid=6627 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1221485210.759:11): user pid=6627 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1221485210.783:12): login pid=6627 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_START msg=audit(1221485210.783:13): user pid=6627 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1221485210.787:14): user pid=6629 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1221485210.807:15): user pid=6627 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)'
>type=USER_AUTH msg=audit(1221485216.507:16): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221485216.507:17): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1221485216.519:18): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1221485216.519:19): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_LOGIN msg=audit(1221486496.907:20): user pid=6720 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1221486499.083:21): user pid=6720 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221486499.083:22): user pid=6720 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1221486499.127:23): user pid=6720 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1221486499.127:24): login pid=6720 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1221486499.127:25): user pid=6720 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1221486499.127:26): user pid=6722 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1221486499.515:27): user pid=6720 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1221486499.519:28): user pid=6720 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1221487100.721:29): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1221487100.721:30): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_LOGIN msg=audit(1221487134.563:31): user pid=6816 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1221487136.791:32): user pid=6816 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221487136.795:33): user pid=6816 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1221487136.835:34): user pid=6816 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1221487136.835:35): login pid=6816 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1221487136.835:36): user pid=6816 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1221487136.839:37): user pid=6819 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1221487136.979:38): user pid=6816 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1221487136.979:39): user pid=6816 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_AUTH msg=audit(1221487173.777:40): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221487173.781:41): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1221487173.781:42): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1221487173.781:43): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221487261.291:44): user pid=6885 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221487261.295:45): user pid=6885 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221487261.295:46): login pid=6885 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1221487261.319:47): user pid=6885 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221487261.351:48): user pid=6885 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221487261.351:49): user pid=6885 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221487474.452:50): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1221487474.452:51): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1221487495.205:52): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221487495.205:53): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1221487495.205:54): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1221487495.205:55): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1221487684.245:56): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1221487684.249:57): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_LOGIN msg=audit(1221488990.727:58): user pid=25328 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_ERR msg=audit(1221488990.999:59): user pid=25328 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct="?" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=failed)'
>type=USER_LOGIN msg=audit(1221488994.107:60): user pid=25330 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1221488995.999:61): user pid=25330 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221488995.999:62): user pid=25330 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1221488996.039:63): user pid=25330 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1221488996.039:64): login pid=25330 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1221488996.039:65): user pid=25330 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1221488996.043:66): user pid=25332 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1221488996.043:67): user pid=25330 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/2 res=success)'
>type=USER_AUTH msg=audit(1221489501.043:68): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221489501.043:69): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1221489501.043:70): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1221489501.043:71): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=ANOM_ABEND msg=audit(1221489551.270:72): auid=500 uid=0 gid=0 ses=1 subj=user_u:system_r:unconfined_t:s0 pid=22936 comm="virsh" sig=11
>type=CRED_DISP msg=audit(1221489573.435:73): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1221489573.435:74): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_AUTH msg=audit(1221489697.507:75): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221489697.507:76): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1221489697.511:77): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1221489697.511:78): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1221489734.829:79): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1221489734.833:80): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221490861.592:81): user pid=19709 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221490861.592:82): user pid=19709 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221490861.592:83): login pid=19709 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_START msg=audit(1221490861.620:84): user pid=19709 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221490861.624:85): user pid=19709 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221490861.624:86): user pid=19709 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221494461.849:87): user pid=19912 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221494461.849:88): user pid=19912 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221494461.849:89): login pid=19912 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_START msg=audit(1221494461.869:90): user pid=19912 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221494461.873:91): user pid=19912 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221494461.873:92): user pid=19912 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221498061.098:93): user pid=20081 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221498061.098:94): user pid=20081 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221498061.098:95): login pid=20081 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
>type=USER_START msg=audit(1221498061.118:96): user pid=20081 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221498061.122:97): user pid=20081 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221498061.122:98): user pid=20081 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221501661.347:99): user pid=20284 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221501661.347:100): user pid=20284 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221501661.347:101): login pid=20284 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=9
>type=USER_START msg=audit(1221501661.367:102): user pid=20284 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221501661.371:103): user pid=20284 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221501661.371:104): user pid=20284 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221505261.596:105): user pid=20453 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221505261.596:106): user pid=20453 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221505261.596:107): login pid=20453 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=10
>type=USER_START msg=audit(1221505261.616:108): user pid=20453 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221505261.620:109): user pid=20453 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221505261.620:110): user pid=20453 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221508861.845:111): user pid=20656 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221508861.845:112): user pid=20656 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221508861.845:113): login pid=20656 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=11
>type=USER_START msg=audit(1221508861.857:114): user pid=20656 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221508861.861:115): user pid=20656 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221508861.861:116): user pid=20656 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221512461.086:117): user pid=20859 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221512461.086:118): user pid=20859 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221512461.086:119): login pid=20859 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=12
>type=USER_START msg=audit(1221512461.106:120): user pid=20859 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221512461.110:121): user pid=20859 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221512461.110:122): user pid=20859 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221516061.335:123): user pid=21028 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221516061.335:124): user pid=21028 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221516061.335:125): login pid=21028 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=13
>type=USER_START msg=audit(1221516061.347:126): user pid=21028 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221516061.351:127): user pid=21028 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221516061.351:128): user pid=21028 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221519661.576:129): user pid=21231 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221519661.576:130): user pid=21231 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221519661.576:131): login pid=21231 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=14
>type=USER_START msg=audit(1221519661.596:132): user pid=21231 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221519661.600:133): user pid=21231 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221519661.600:134): user pid=21231 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221523261.825:135): user pid=21400 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221523261.825:136): user pid=21400 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221523261.825:137): login pid=21400 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=15
>type=USER_START msg=audit(1221523261.845:138): user pid=21400 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221523261.849:139): user pid=21400 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221523261.849:140): user pid=21400 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221526861.074:141): user pid=21603 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221526861.074:142): user pid=21603 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221526861.074:143): login pid=21603 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=16
>type=USER_START msg=audit(1221526861.094:144): user pid=21603 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221526861.098:145): user pid=21603 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221526861.098:146): user pid=21603 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221530461.323:147): user pid=21806 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221530461.323:148): user pid=21806 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221530461.323:149): login pid=21806 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=17
>type=USER_START msg=audit(1221530461.343:150): user pid=21806 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221530461.347:151): user pid=21806 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221530461.347:152): user pid=21806 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221534061.572:153): user pid=21975 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221534061.572:154): user pid=21975 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221534061.572:155): login pid=21975 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=18
>type=USER_START msg=audit(1221534061.584:156): user pid=21975 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221534061.588:157): user pid=21975 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221534061.588:158): user pid=21975 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221534121.591:159): user pid=21978 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221534121.591:160): user pid=21978 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221534121.591:161): login pid=21978 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=19
>type=USER_START msg=audit(1221534121.611:162): user pid=21978 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221534124.011:163): user pid=21978 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221534124.011:164): user pid=21978 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221537661.233:165): user pid=22793 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221537661.237:166): user pid=22793 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221537661.237:167): login pid=22793 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=20
>type=USER_START msg=audit(1221537661.265:168): user pid=22793 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221537661.269:169): user pid=22793 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221537661.269:170): user pid=22793 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221541261.494:171): user pid=22962 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221541261.494:172): user pid=22962 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221541261.494:173): login pid=22962 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=21
>type=USER_START msg=audit(1221541261.518:174): user pid=22962 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221541261.522:175): user pid=22962 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221541261.522:176): user pid=22962 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221544861.747:177): user pid=23165 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221544861.747:178): user pid=23165 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221544861.747:179): login pid=23165 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=22
>type=USER_START msg=audit(1221544861.759:180): user pid=23165 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221544861.759:181): user pid=23165 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221544861.763:182): user pid=23165 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221548461.988:183): user pid=23334 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221548461.988:184): user pid=23334 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221548461.988:185): login pid=23334 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=23
>type=USER_START msg=audit(1221548462.008:186): user pid=23334 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221548462.012:187): user pid=23334 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221548462.012:188): user pid=23334 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221552061.236:189): user pid=23537 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221552061.236:190): user pid=23537 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221552061.236:191): login pid=23537 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=24
>type=USER_START msg=audit(1221552061.248:192): user pid=23537 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221552061.252:193): user pid=23537 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221552061.252:194): user pid=23537 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221555661.477:195): user pid=23706 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221555661.477:196): user pid=23706 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221555661.477:197): login pid=23706 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=25
>type=USER_START msg=audit(1221555661.497:198): user pid=23706 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221555661.501:199): user pid=23706 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221555661.501:200): user pid=23706 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221559261.726:201): user pid=23909 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221559261.726:202): user pid=23909 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221559261.726:203): login pid=23909 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=26
>type=USER_START msg=audit(1221559261.738:204): user pid=23909 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221559261.742:205): user pid=23909 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221559261.742:206): user pid=23909 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221562861.967:207): user pid=24078 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221562861.967:208): user pid=24078 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221562861.967:209): login pid=24078 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=27
>type=USER_START msg=audit(1221562861.979:210): user pid=24078 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221562861.983:211): user pid=24078 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221562861.983:212): user pid=24078 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221566461.208:213): user pid=24281 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221566461.208:214): user pid=24281 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221566461.208:215): login pid=24281 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=28
>type=USER_START msg=audit(1221566461.220:216): user pid=24281 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221566461.224:217): user pid=24281 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221566461.224:218): user pid=24281 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221570061.449:219): user pid=24450 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221570061.449:220): user pid=24450 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221570061.449:221): login pid=24450 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=29
>type=USER_START msg=audit(1221570061.469:222): user pid=24450 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221570061.473:223): user pid=24450 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221570061.473:224): user pid=24450 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_LOGIN msg=audit(1221573537.215:225): user pid=24615 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.130, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1221573541.483:226): user pid=24615 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221573541.483:227): user pid=24615 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1221573541.527:228): user pid=24615 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)'
>type=LOGIN msg=audit(1221573541.531:229): login pid=24615 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=30
>type=USER_START msg=audit(1221573541.531:230): user pid=24615 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1221573541.531:231): user pid=24617 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1221573541.559:232): user pid=24615 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=/dev/pts/3 res=success)'
>type=USER_AUTH msg=audit(1221573615.524:233): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=USER_ACCT msg=audit(1221573615.524:234): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=USER_START msg=audit(1221573615.524:235): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=CRED_ACQ msg=audit(1221573615.524:236): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=CRED_DISP msg=audit(1221573647.814:237): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=USER_END msg=audit(1221573647.814:238): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=USER_ACCT msg=audit(1221573661.698:239): user pid=24675 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221573661.698:240): user pid=24675 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221573661.698:241): login pid=24675 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=31
>type=USER_START msg=audit(1221573661.718:242): user pid=24675 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221573661.722:243): user pid=24675 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221573661.722:244): user pid=24675 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1221573882.960:245): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=USER_ACCT msg=audit(1221573882.964:246): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=USER_START msg=audit(1221573882.964:247): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=CRED_ACQ msg=audit(1221573882.964:248): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=CRED_DISP msg=audit(1221574025.313:249): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=USER_END msg=audit(1221574025.317:250): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
>type=CRED_DISP msg=audit(1221574026.289:251): user pid=24615 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)'
>type=USER_END msg=audit(1221574026.289:252): user pid=24615 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221577261.947:253): user pid=24939 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221577261.947:254): user pid=24939 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221577261.947:255): login pid=24939 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=32
>type=USER_START msg=audit(1221577261.967:256): user pid=24939 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221577261.971:257): user pid=24939 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221577261.971:258): user pid=24939 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221580861.196:259): user pid=25108 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221580861.196:260): user pid=25108 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221580861.196:261): login pid=25108 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=33
>type=USER_START msg=audit(1221580861.216:262): user pid=25108 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221580861.220:263): user pid=25108 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221580861.220:264): user pid=25108 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221584461.445:265): user pid=25311 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221584461.445:266): user pid=25311 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221584461.445:267): login pid=25311 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=34
>type=USER_START msg=audit(1221584461.469:268): user pid=25311 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221584461.473:269): user pid=25311 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221584461.473:270): user pid=25311 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221588061.698:271): user pid=25518 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221588061.698:272): user pid=25518 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221588061.698:273): login pid=25518 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=35
>type=USER_START msg=audit(1221588061.718:274): user pid=25518 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221588061.722:275): user pid=25518 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221588061.722:276): user pid=25518 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221591661.947:277): user pid=25687 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221591661.947:278): user pid=25687 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221591661.947:279): login pid=25687 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=36
>type=USER_START msg=audit(1221591661.971:280): user pid=25687 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221591661.975:281): user pid=25687 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221591661.975:282): user pid=25687 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221595261.200:283): user pid=25890 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221595261.200:284): user pid=25890 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221595261.200:285): login pid=25890 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=37
>type=USER_START msg=audit(1221595261.220:286): user pid=25890 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221595261.224:287): user pid=25890 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221595261.224:288): user pid=25890 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221598861.449:289): user pid=26059 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221598861.449:290): user pid=26059 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221598861.449:291): login pid=26059 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=38
>type=USER_START msg=audit(1221598861.473:292): user pid=26059 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221598861.477:293): user pid=26059 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221598861.477:294): user pid=26059 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221602461.702:295): user pid=26228 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221602461.702:296): user pid=26228 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221602461.702:297): login pid=26228 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=39
>type=USER_START msg=audit(1221602461.722:298): user pid=26228 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221602461.726:299): user pid=26228 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221602461.726:300): user pid=26228 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221606061.951:301): user pid=26431 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221606061.951:302): user pid=26431 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221606061.951:303): login pid=26431 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=40
>type=USER_START msg=audit(1221606061.971:304): user pid=26431 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221606061.975:305): user pid=26431 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221606061.975:306): user pid=26431 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221609661.200:307): user pid=26634 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221609661.200:308): user pid=26634 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221609661.200:309): login pid=26634 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=41
>type=USER_START msg=audit(1221609661.220:310): user pid=26634 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221609661.224:311): user pid=26634 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221609661.224:312): user pid=26634 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221613261.449:313): user pid=26837 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221613261.449:314): user pid=26837 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221613261.449:315): login pid=26837 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=42
>type=USER_START msg=audit(1221613261.469:316): user pid=26837 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221613261.473:317): user pid=26837 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221613261.473:318): user pid=26837 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221616861.698:319): user pid=27006 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221616861.698:320): user pid=27006 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221616861.698:321): login pid=27006 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=43
>type=USER_START msg=audit(1221616861.718:322): user pid=27006 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221616861.722:323): user pid=27006 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221616861.722:324): user pid=27006 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221620461.947:325): user pid=27175 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221620461.947:326): user pid=27175 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221620461.947:327): login pid=27175 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=44
>type=USER_START msg=audit(1221620461.967:328): user pid=27175 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221620461.971:329): user pid=27175 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221620461.971:330): user pid=27175 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221620521.975:331): user pid=27178 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221620521.975:332): user pid=27178 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221620521.975:333): login pid=27178 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=45
>type=USER_START msg=audit(1221620521.995:334): user pid=27178 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221620529.003:335): user pid=27178 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221620529.003:336): user pid=27178 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221624061.224:337): user pid=27871 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221624061.228:338): user pid=27871 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221624061.228:339): login pid=27871 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=46
>type=USER_START msg=audit(1221624061.248:340): user pid=27871 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221624061.252:341): user pid=27871 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221624061.252:342): user pid=27871 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221627661.477:343): user pid=28040 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221627661.477:344): user pid=28040 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221627661.477:345): login pid=28040 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=47
>type=USER_START msg=audit(1221627661.497:346): user pid=28040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221627661.501:347): user pid=28040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221627661.501:348): user pid=28040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221631261.726:349): user pid=28243 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221631261.726:350): user pid=28243 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221631261.726:351): login pid=28243 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=48
>type=USER_START msg=audit(1221631261.746:352): user pid=28243 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221631261.750:353): user pid=28243 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221631261.750:354): user pid=28243 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221634861.975:355): user pid=28412 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221634861.975:356): user pid=28412 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221634861.975:357): login pid=28412 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=49
>type=USER_START msg=audit(1221634861.995:358): user pid=28412 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221634861.999:359): user pid=28412 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221634861.999:360): user pid=28412 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221638461.224:361): user pid=28614 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221638461.224:362): user pid=28614 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221638461.224:363): login pid=28614 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=50
>type=USER_START msg=audit(1221638461.244:364): user pid=28614 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221638461.248:365): user pid=28614 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221638461.248:366): user pid=28614 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_ACCT msg=audit(1221642061.473:367): user pid=28784 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221642061.473:368): user pid=28784 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221642061.473:369): login pid=28784 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=51
>type=USER_START msg=audit(1221642061.493:370): user pid=28784 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221642061.497:371): user pid=28784 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221642061.497:372): user pid=28784 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_AUTH msg=audit(1221645563.636:373): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221645563.636:374): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1221645563.640:375): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1221645563.640:376): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1221645623.112:377): user pid=25330 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1221645623.112:378): user pid=25330 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221645661.722:379): user pid=29018 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_ACQ msg=audit(1221645661.726:380): user pid=29018 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=LOGIN msg=audit(1221645661.726:381): login pid=29018 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=52
>type=USER_START msg=audit(1221645661.786:382): user pid=29018 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=CRED_DISP msg=audit(1221645661.790:383): user pid=29018 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_END msg=audit(1221645661.790:384): user pid=29018 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
>type=USER_CHAUTHTOK msg=audit(1221645731.594:385): user pid=29091 uid=0 auid=500 subj=user_u:system_r:useradd_t:s0 msg='op=adding user acct=dbus exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/1 res=failed)'
>type=USER_CHAUTHTOK msg=audit(1221645765.149:386): user pid=29163 uid=0 auid=500 subj=user_u:system_r:useradd_t:s0 msg='op=adding user acct=sshd exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/1 res=failed)'
>type=USER_CHAUTHTOK msg=audit(1221645781.894:387): user pid=29283 uid=0 auid=500 subj=user_u:system_r:useradd_t:s0 msg='op=adding user acct=rpcuser exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/1 res=failed)'
>type=USER_CHAUTHTOK msg=audit(1221645790.774:388): user pid=29348 uid=0 auid=500 subj=user_u:system_r:groupadd_t:s0 msg='op=adding group acct=ntp exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=pts/1 res=failed)'
>type=USER_CHAUTHTOK msg=audit(1221645790.778:389): user pid=29349 uid=0 auid=500 subj=user_u:system_r:useradd_t:s0 msg='op=adding user acct=ntp exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/1 res=failed)'
>type=USER_CHAUTHTOK msg=audit(1221645792.834:390): user pid=29353 uid=0 auid=500 subj=user_u:system_r:groupadd_t:s0 msg='op=adding group acct=pcap exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=pts/1 res=failed)'
>type=USER_CHAUTHTOK msg=audit(1221645792.834:391): user pid=29354 uid=0 auid=500 subj=user_u:system_r:useradd_t:s0 msg='op=adding user acct=pcap exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/1 res=failed)'
>type=MAC_POLICY_LOAD msg=audit(1221645802.171:392): policy loaded auid=500 ses=1
>type=SYSCALL msg=audit(1221645802.171:392): arch=40000003 syscall=4 success=yes exit=1409762 a0=4 a1=b7e3a000 a2=1582e2 a3=bf88dde8 items=0 ppid=29367 pid=29368 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="load_policy" exe="/usr/sbin/load_policy" subj=user_u:system_r:load_policy_t:s0 key=(null)
>type=USER_AVC msg=audit(1221645802.231:393): user pid=5207 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc:  received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)'
>type=AVC msg=audit(1221645886.416:394): avc:  denied  { read } for  pid=29880 comm="cupsd" name="tmp" dev=dm-4 ino=786630 scontext=user_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir
>type=SYSCALL msg=audit(1221645886.416:394): arch=40000003 syscall=5 success=no exit=-13 a0=9b0a8a8 a1=18800 a2=2f2ba4 a3=9b1ac38 items=0 ppid=29879 pid=29880 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="cupsd" exe="/usr/sbin/cupsd" subj=user_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1221646042.790:395): user pid=6627 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1221646042.794:396): user pid=6627 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1221646042.798:397): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1221646042.798:398): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=DAEMON_END msg=audit(1221646044.493:7302): auditd normal halt, sending auid=4294967295 pid=30712 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1221745534.741:5755): auditd start, ver=1.6.5 format=raw kernel=2.6.18-115.el5xen auid=4294967295 pid=2653 res=success
>type=CONFIG_CHANGE msg=audit(1221745534.839:2): audit_enabled=1 old=0 by auid=4294967295 res=1
>type=CONFIG_CHANGE msg=audit(1221745534.847:3): audit_backlog_limit=320 old=64 by auid=4294967295 res=1
>type=ANOM_PROMISCUOUS msg=audit(1221745550.100:4): dev=vif0.1 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1221745550.100:4): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfe9d2d0 a3=1 items=0 ppid=3602 pid=3790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1221745553.300:5): dev=peth1 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1221745553.300:5): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf987dc0 a3=1 items=0 ppid=3602 pid=3805 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" key=(null)
>type=USER_LOGIN msg=audit(1221745562.757:6): user pid=4222 uid=0 auid=4294967295 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1221745564.501:7): user pid=4222 uid=0 auid=4294967295 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221745564.501:8): user pid=4222 uid=0 auid=4294967295 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1221745564.501:9): user pid=4222 uid=0 auid=4294967295 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1221745564.521:10): login pid=4222 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_START msg=audit(1221745564.525:11): user pid=4222 uid=0 auid=500 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1221745564.525:12): user pid=4224 uid=0 auid=500 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1221745564.557:13): user pid=4222 uid=0 auid=500 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)'
>type=USER_AUTH msg=audit(1221746055.644:14): user pid=4273 uid=500 auid=500 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221746055.644:15): user pid=4273 uid=500 auid=500 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1221746055.684:16): user pid=4273 uid=500 auid=500 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1221746055.684:17): user pid=4273 uid=500 auid=500 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1221746073.469:18): user pid=4222 uid=0 auid=500 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1221746073.469:19): user pid=4222 uid=0 auid=500 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1221746073.473:20): user pid=4273 uid=500 auid=500 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1221746073.473:21): user pid=4273 uid=500 auid=500 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=DAEMON_END msg=audit(1221746074.765:5756): auditd normal halt, sending auid=4294967295 pid=4803 subj= res=success
>type=DAEMON_START msg=audit(1221746264.707:2395): auditd start, ver=1.6.5 format=raw kernel=2.6.18-115.el5xen auid=4294967295 pid=2689 res=success
>type=CONFIG_CHANGE msg=audit(1221746264.803:72): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1221746264.811:73): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=AVC msg=audit(1221746268.715:74): avc:  denied  { read } for  pid=3052 comm="cupsd" name="tmp" dev=dm-4 ino=786630 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir
>type=SYSCALL msg=audit(1221746268.715:74): arch=40000003 syscall=5 success=yes exit=2 a0=88768a8 a1=18800 a2=7c2ba4 a3=8886c38 items=0 ppid=3051 pid=3052 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cupsd" exe="/usr/sbin/cupsd" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=USER_LOGIN msg=audit(1221746275.100:75): user pid=3312 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1221746276.984:76): user pid=3312 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221746276.984:77): user pid=3312 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1221746277.036:78): user pid=3312 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1221746277.036:79): login pid=3312 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_START msg=audit(1221746277.036:80): user pid=3312 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1221746277.036:81): user pid=3333 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1221746277.076:82): user pid=3312 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)'
>type=AVC msg=audit(1221746279.816:83): avc:  denied  { search } for  pid=3674 comm="xenstored" name="/" dev=tmpfs ino=17787 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
>type=SYSCALL msg=audit(1221746279.816:83): arch=40000003 syscall=5 success=no exit=-2 a0=8fc1118 a1=8002 a2=0 a3=8002 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746279.816:84): avc:  denied  { write } for  pid=3674 comm="xenstored" name="/" dev=tmpfs ino=17787 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
>type=AVC msg=audit(1221746279.816:84): avc:  denied  { add_name } for  pid=3674 comm="xenstored" name="tdb" scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
>type=AVC msg=audit(1221746279.816:84): avc:  denied  { create } for  pid=3674 comm="xenstored" name="tdb" scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746279.816:84): arch=40000003 syscall=5 success=yes exit=8 a0=8fc1118 a1=8042 a2=1a0 a3=8042 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746279.816:85): avc:  denied  { lock } for  pid=3674 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=18118 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746279.816:85): arch=40000003 syscall=221 success=yes exit=0 a0=8 a1=e a2=bfef8074 a3=bfef8074 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746279.816:86): avc:  denied  { read } for  pid=3674 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=18118 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746279.816:86): arch=40000003 syscall=3 success=yes exit=0 a0=8 a1=8fc1184 a2=a8 a3=804fe30 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746279.816:87): avc:  denied  { write } for  pid=3674 comm="xenstored" name="tdb" dev=tmpfs ino=18118 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746279.816:87): arch=40000003 syscall=194 success=yes exit=0 a0=8 a1=0 a2=0 a3=8fc1168 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746279.816:88): avc:  denied  { getattr } for  pid=3674 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=18118 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746279.816:88): arch=40000003 syscall=197 success=yes exit=0 a0=8 a1=bfef80d8 a2=50dff4 a3=0 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746279.852:89): avc:  denied  { remove_name } for  pid=3674 comm="xenstored" name="tdb.0x8fd0f50" dev=tmpfs ino=18122 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
>type=AVC msg=audit(1221746279.852:89): avc:  denied  { unlink } for  pid=3674 comm="xenstored" name="tdb.0x8fd0f50" dev=tmpfs ino=18122 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746279.852:89): arch=40000003 syscall=10 success=yes exit=0 a0=8fd1c78 a1=1 a2=8fd0f50 a3=804e020 items=0 ppid=1 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746279.852:90): avc:  denied  { rename } for  pid=3674 comm="xenstored" name="tdb.0x8fd0f50" dev=tmpfs ino=18123 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746279.852:90): arch=40000003 syscall=38 success=yes exit=0 a0=8fd1160 a1=805a3e0 a2=8fd20e0 a3=8fd0f50 items=0 ppid=1 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1221746280.520:91): dev=vif0.1 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1221746280.520:91): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf9e6610 a3=1 items=0 ppid=3693 pid=3881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1221746283.716:92): dev=peth1 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1221746283.716:92): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfbaa7e0 a3=1 items=0 ppid=3693 pid=3896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null)
>type=USER_AUTH msg=audit(1221746339.172:93): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221746339.172:94): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1221746339.188:95): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1221746339.188:96): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_DISP msg=audit(1221746355.377:97): user pid=3312 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_END msg=audit(1221746355.377:98): user pid=3312 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_DISP msg=audit(1221746355.381:99): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_END msg=audit(1221746355.381:100): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=DAEMON_END msg=audit(1221746356.962:2396): auditd normal halt, sending auid=4294967295 pid=4910 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1221746686.413:9898): auditd start, ver=1.6.5 format=raw kernel=2.6.18-115.el5xen auid=4294967295 pid=2664 res=success
>type=CONFIG_CHANGE msg=audit(1221746686.512:7): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
>type=CONFIG_CHANGE msg=audit(1221746686.520:8): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=AVC msg=audit(1221746691.684:9): avc:  denied  { read } for  pid=3025 comm="cupsd" name="tmp" dev=dm-4 ino=786630 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir
>type=SYSCALL msg=audit(1221746691.684:9): arch=40000003 syscall=5 success=yes exit=2 a0=89e78a8 a1=18800 a2=3f4ba4 a3=89f7c38 items=0 ppid=3024 pid=3025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cupsd" exe="/usr/sbin/cupsd" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1221746704.853:10): avc:  denied  { search } for  pid=3613 comm="xenstored" name="/" dev=tmpfs ino=11892 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
>type=SYSCALL msg=audit(1221746704.853:10): arch=40000003 syscall=5 success=no exit=-2 a0=8295118 a1=8002 a2=0 a3=8002 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746704.853:11): avc:  denied  { write } for  pid=3613 comm="xenstored" name="/" dev=tmpfs ino=11892 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
>type=AVC msg=audit(1221746704.853:11): avc:  denied  { add_name } for  pid=3613 comm="xenstored" name="tdb" scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
>type=AVC msg=audit(1221746704.853:11): avc:  denied  { create } for  pid=3613 comm="xenstored" name="tdb" scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746704.853:11): arch=40000003 syscall=5 success=yes exit=8 a0=8295118 a1=8042 a2=1a0 a3=8042 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746704.853:12): avc:  denied  { lock } for  pid=3613 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=12188 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746704.853:12): arch=40000003 syscall=221 success=yes exit=0 a0=8 a1=e a2=bffa9124 a3=bffa9124 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746704.853:13): avc:  denied  { read } for  pid=3613 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=12188 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746704.853:13): arch=40000003 syscall=3 success=yes exit=0 a0=8 a1=8295184 a2=a8 a3=804fe30 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746704.853:14): avc:  denied  { write } for  pid=3613 comm="xenstored" name="tdb" dev=tmpfs ino=12188 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746704.853:14): arch=40000003 syscall=194 success=yes exit=0 a0=8 a1=0 a2=0 a3=8295168 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746704.853:15): avc:  denied  { getattr } for  pid=3613 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=12188 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746704.853:15): arch=40000003 syscall=197 success=yes exit=0 a0=8 a1=bffa9188 a2=50dff4 a3=0 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746704.897:16): avc:  denied  { remove_name } for  pid=3613 comm="xenstored" name="tdb.0x82a4da8" dev=tmpfs ino=12195 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir
>type=AVC msg=audit(1221746704.897:16): avc:  denied  { unlink } for  pid=3613 comm="xenstored" name="tdb.0x82a4da8" dev=tmpfs ino=12195 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746704.897:16): arch=40000003 syscall=10 success=yes exit=0 a0=82a5a10 a1=1 a2=82a4da8 a3=804e020 items=0 ppid=1 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=AVC msg=audit(1221746704.897:17): avc:  denied  { rename } for  pid=3613 comm="xenstored" name="tdb.0x82a4da8" dev=tmpfs ino=12196 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file
>type=SYSCALL msg=audit(1221746704.897:17): arch=40000003 syscall=38 success=yes exit=0 a0=82a5cb0 a1=805a3e0 a2=82a4c68 a3=82a4da8 items=0 ppid=1 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1221746705.693:18): dev=vif0.1 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1221746705.693:18): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfa42670 a3=1 items=0 ppid=3632 pid=3820 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1221746708.881:19): dev=peth1 prom=256 old_prom=0 auid=4294967295 ses=4294967295
>type=SYSCALL msg=audit(1221746708.881:19): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf8d0d00 a3=1 items=0 ppid=3632 pid=3835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null)
>type=USER_LOGIN msg=audit(1221746719.366:20): user pid=4249 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)'
>type=USER_AUTH msg=audit(1221746721.002:21): user pid=4249 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_ACCT msg=audit(1221746721.002:22): user pid=4249 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_ACQ msg=audit(1221746721.046:23): user pid=4249 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=LOGIN msg=audit(1221746721.054:24): login pid=4249 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_START msg=audit(1221746721.058:25): user pid=4249 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=CRED_REFR msg=audit(1221746721.058:26): user pid=4251 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)'
>type=USER_LOGIN msg=audit(1221746721.114:27): user pid=4249 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)'
>type=USER_AUTH msg=audit(1221746724.062:28): user pid=4281 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_ACCT msg=audit(1221746724.062:29): user pid=4281 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=USER_START msg=audit(1221746724.094:30): user pid=4281 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
>type=CRED_ACQ msg=audit(1221746724.094:31): user pid=4281 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'

Actions: View

Attachments on bug 462702: 317084 | 317085 | 317102 | 317127 | 317172 | 317180