Login
[x]
Log in using an account from:
Fedora Account System
Red Hat Associate
Red Hat Customer
Or login using a Red Hat Bugzilla account
Forgot Password
Login:
Hide Forgot
Create an Account
Red Hat Bugzilla – Attachment 317085 Details for
Bug 462702
xenstored fails to start because selinux prevents access to files on tmpfs
[?]
New
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
|
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh83 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
This site requires JavaScript to be enabled to function correctly, please enable it.
/var/log/audit/audit.log
audit.log (text/plain), 155.30 KB, created by
Richard W.M. Jones
on 2008-09-18 14:18:11 UTC
(
hide
)
Description:
/var/log/audit/audit.log
Filename:
MIME Type:
Creator:
Richard W.M. Jones
Created:
2008-09-18 14:18:11 UTC
Size:
155.30 KB
patch
obsolete
>type=DAEMON_START msg=audit(1211544397.863:8599): auditd start, ver=1.6.5 format=raw kernel=2.6.18-92.el5 auid=4294967295 pid=5901 res=success >type=CONFIG_CHANGE msg=audit(1211544397.964:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1 >type=CONFIG_CHANGE msg=audit(1211544397.969:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 >type=USYS_CONFIG msg=audit(1211545810.999:6): user pid=6630 uid=0 auid=4294967295 subj=system_u:system_r:firstboot_t:s0 msg='changing system time: exe="/sbin/hwclock" (hostname=?, addr=?, terminal=pts/0 res=success)' >type=USER_AUTH msg=audit(1211545856.433:7): user pid=6764 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)' >type=USER_ACCT msg=audit(1211545856.434:8): user pid=6764 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)' >type=CRED_ACQ msg=audit(1211545856.434:9): user pid=6764 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)' >type=LOGIN msg=audit(1211545856.443:10): login pid=6764 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1 >type=USER_START msg=audit(1211545856.450:11): user pid=6764 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)' >type=USER_LOGIN msg=audit(1211545856.451:12): user pid=6764 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/gdm-binary" (hostname=intel-mb, addr=192.168.2.134, terminal=:0 res=success)' >type=USER_AUTH msg=audit(1211545919.864:13): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1211545919.864:14): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1211545919.902:15): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1211545919.903:16): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_AUTH msg=audit(1211546305.869:17): user pid=7835 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=failed)' >type=USER_AUTH msg=audit(1211546308.271:18): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=USER_ACCT msg=audit(1211546308.271:19): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=USER_START msg=audit(1211546308.276:20): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=CRED_ACQ msg=audit(1211546308.276:21): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=AVC msg=audit(1211546441.092:22): avc: denied { associate } for pid=7864 comm="cp" name="grub.conf" scontext=user_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem >type=SYSCALL msg=audit(1211546441.092:22): arch=40000003 syscall=5 success=no exit=-13 a0=bfca3a2d a1=8041 a2=8180 a3=8041 items=0 ppid=7042 pid=7864 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="cp" exe="/bin/cp" subj=user_u:system_r:unconfined_t:s0 key=(null) >type=AVC msg=audit(1211546460.435:23): avc: denied { associate } for pid=7872 comm="cp" name="grub.conf" scontext=user_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem >type=SYSCALL msg=audit(1211546460.435:23): arch=40000003 syscall=5 success=no exit=-13 a0=bfb65a2d a1=8041 a2=8180 a3=8041 items=0 ppid=7042 pid=7872 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="cp" exe="/bin/cp" subj=user_u:system_r:unconfined_t:s0 key=(null) >type=CRED_DISP msg=audit(1211546487.876:24): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1211546487.876:25): user pid=7039 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_DISP msg=audit(1211546487.878:26): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=USER_END msg=audit(1211546487.878:27): user pid=7836 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=USER_END msg=audit(1211546487.934:28): user pid=6764 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)' >type=CRED_DISP msg=audit(1211546487.935:29): user pid=6764 uid=0 auid=500 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=success)' >type=DAEMON_END msg=audit(1211546491.817:8600): auditd normal halt, sending auid=4294967295 pid=8393 subj=system_u:system_r:initrc_t:s0 res=success >type=DAEMON_START msg=audit(1211546578.528:2837): auditd start, ver=1.6.5 format=raw kernel=2.6.18-92.el5xen auid=4294967295 pid=5895 res=success >type=CONFIG_CHANGE msg=audit(1211546578.628:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1 >type=CONFIG_CHANGE msg=audit(1211546578.640:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 >type=USER_LOGIN msg=audit(1211546764.992:6): user pid=6771 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1211546767.640:7): user pid=6771 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1211546767.644:8): user pid=6771 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1211546767.688:9): user pid=6771 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1211546767.696:10): login pid=6771 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1 >type=USER_START msg=audit(1211546767.696:11): user pid=6771 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1211546767.700:12): user pid=6774 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1211546767.788:13): user pid=6771 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)' >type=CRED_DISP msg=audit(1211546805.734:14): user pid=6771 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1211546805.738:15): user pid=6771 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1211546807.058:16): user pid=6812 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1211546807.102:17): user pid=6812 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1211546807.102:18): login pid=6812 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2 >type=USER_START msg=audit(1211546807.106:19): user pid=6812 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1211546807.106:20): user pid=6814 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1211546807.114:21): user pid=6812 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)' >type=USER_AUTH msg=audit(1211546842.032:22): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1211546842.032:23): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1211546842.052:24): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1211546842.052:25): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=ANOM_PROMISCUOUS msg=audit(1211547120.482:26): dev=vif0.1 prom=256 old_prom=0 auid=500 ses=2 >type=SYSCALL msg=audit(1211547120.482:26): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfbc14a0 a3=1 items=0 ppid=7042 pid=7353 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="brctl" exe="/usr/sbin/brctl" subj=user_u:system_r:xend_t:s0 key=(null) >type=ANOM_PROMISCUOUS msg=audit(1211547123.582:27): dev=peth1 prom=256 old_prom=0 auid=500 ses=2 >type=SYSCALL msg=audit(1211547123.582:27): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfc1b500 a3=1 items=0 ppid=7042 pid=7368 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="brctl" exe="/usr/sbin/brctl" subj=user_u:system_r:xend_t:s0 key=(null) >type=USER_ACCT msg=audit(1211547195.514:28): user pid=7560 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1211547195.558:29): user pid=7560 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1211547195.558:30): login pid=7560 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=3 >type=USER_START msg=audit(1211547195.558:31): user pid=7560 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1211547195.558:32): user pid=7562 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1211547195.566:33): user pid=7560 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/2 res=success)' >type=USER_AUTH msg=audit(1211547208.703:34): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=USER_ACCT msg=audit(1211547208.707:35): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=USER_START msg=audit(1211547208.719:36): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=CRED_ACQ msg=audit(1211547208.719:37): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=ANOM_PROMISCUOUS msg=audit(1211547359.385:38): dev=vif1.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1211547359.385:38): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfef8b30 a3=1 items=0 ppid=7691 pid=7753 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null) >type=USER_ACCT msg=audit(1211547661.844:39): user pid=7908 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1211547661.844:40): user pid=7908 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1211547661.844:41): login pid=7908 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4 >type=USER_START msg=audit(1211547661.868:42): user pid=7908 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1211547661.904:43): user pid=7908 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1211547661.904:44): user pid=7908 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=ANOM_PROMISCUOUS msg=audit(1211548181.648:45): dev=vif1.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295 >type=ANOM_PROMISCUOUS msg=audit(1211548217.910:46): dev=vif2.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1211548217.910:46): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfb66fa0 a3=1 items=0 ppid=8290 pid=8341 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null) >type=ANOM_PROMISCUOUS msg=audit(1211548277.546:47): dev=vif2.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295 >type=ANOM_PROMISCUOUS msg=audit(1211548358.059:48): dev=vif3.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1211548358.059:48): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf9bd5f0 a3=1 items=0 ppid=8643 pid=8685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null) >type=ANOM_PROMISCUOUS msg=audit(1211548442.704:49): dev=vif3.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295 >type=CRED_DISP msg=audit(1211549130.275:50): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=USER_END msg=audit(1211549130.275:51): user pid=7592 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=CRED_DISP msg=audit(1211549130.823:52): user pid=7560 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1211549130.827:53): user pid=7560 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1211549138.616:54): user pid=8925 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1211549138.660:55): user pid=8925 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1211549138.660:56): login pid=8925 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=5 >type=USER_START msg=audit(1211549138.660:57): user pid=8925 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1211549138.664:58): user pid=8927 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1211549138.672:59): user pid=8925 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/2 res=success)' >type=USER_AUTH msg=audit(1211549140.892:60): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=USER_ACCT msg=audit(1211549140.892:61): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=USER_START msg=audit(1211549140.904:62): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=CRED_ACQ msg=audit(1211549140.904:63): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=ANOM_PROMISCUOUS msg=audit(1211549181.707:64): dev=vif4.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1211549181.707:64): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfb1c750 a3=1 items=0 ppid=9065 pid=9120 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null) >type=ANOM_PROMISCUOUS msg=audit(1211549636.031:65): dev=vif4.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295 >type=ANOM_PROMISCUOUS msg=audit(1211549657.068:66): dev=vif6.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1211549657.068:66): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bffef420 a3=1 items=0 ppid=9503 pid=9586 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null) >type=USER_ACCT msg=audit(1211551261.189:67): user pid=31753 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1211551261.189:68): user pid=31753 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1211551261.189:69): login pid=31753 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6 >type=USER_START msg=audit(1211551261.205:70): user pid=31753 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1211551261.233:71): user pid=31753 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1211551261.233:72): user pid=31753 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=ANOM_PROMISCUOUS msg=audit(1211551848.573:73): dev=vif6.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295 >type=ANOM_PROMISCUOUS msg=audit(1211551850.505:74): dev=vif7.0 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1211551850.505:74): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf926d60 a3=1 items=0 ppid=32157 pid=32199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:udev_t:s0-s0:c0.c1023 key=(null) >type=CRED_DISP msg=audit(1211552595.860:75): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1211552595.860:76): user pid=6844 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_DISP msg=audit(1211552596.268:77): user pid=6812 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1211552596.268:78): user pid=6812 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1211552600.360:79): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=USER_END msg=audit(1211552600.364:80): user pid=8957 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/2 res=success)' >type=CRED_DISP msg=audit(1211552600.588:81): user pid=8925 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1211552600.588:82): user pid=8925 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1211553427.924:83): user pid=32619 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1211553428.012:84): user pid=32619 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1211553428.016:85): login pid=32619 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=7 >type=USER_START msg=audit(1211553428.016:86): user pid=32619 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1211553428.016:87): user pid=32621 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1211553428.048:88): user pid=32619 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)' >type=CRED_DISP msg=audit(1211553429.292:89): user pid=32619 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1211553429.292:90): user pid=32619 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1211553434.336:91): user pid=32652 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1211553434.376:92): user pid=32652 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1211553434.376:93): login pid=32652 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=8 >type=USER_START msg=audit(1211553434.380:94): user pid=32652 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1211553434.380:95): user pid=32654 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1211553434.388:96): user pid=32652 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)' >type=USER_AUTH msg=audit(1211553436.225:97): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1211553436.225:98): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1211553436.233:99): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1211553436.233:100): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_DISP msg=audit(1211553452.170:101): user pid=32652 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1211553452.174:102): user pid=32652 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1211553452.178:103): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1211553452.178:104): user pid=32684 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1211553485.876:105): user pid=32709 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1211553485.916:106): user pid=32709 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1211553485.916:107): login pid=32709 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=9 >type=USER_START msg=audit(1211553485.916:108): user pid=32709 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1211553485.916:109): user pid=32711 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1211553485.924:110): user pid=32709 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)' >type=USER_AUTH msg=audit(1211553489.200:111): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1211553489.204:112): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1211553489.236:113): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1211553489.236:114): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=ANOM_PROMISCUOUS msg=audit(1211553520.606:115): dev=vif7.0 prom=0 old_prom=256 auid=4294967295 ses=4294967295 >type=CRED_DISP msg=audit(1211553567.901:116): user pid=32709 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1211553567.901:117): user pid=32709 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1211553567.905:118): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1211553567.905:119): user pid=32741 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=DAEMON_END msg=audit(1211553572.796:2838): auditd normal halt, sending auid=4294967295 pid=1031 subj=system_u:system_r:initrc_t:s0 res=success >type=DAEMON_START msg=audit(1221481475.145:892): auditd start, ver=1.6.5 format=raw kernel=2.6.18-92.el5xen auid=4294967295 pid=5049 res=success >type=CONFIG_CHANGE msg=audit(1221481475.243:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1 >type=CONFIG_CHANGE msg=audit(1221481475.251:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 >type=ANOM_PROMISCUOUS msg=audit(1221481522.614:6): dev=vif0.1 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1221481522.614:6): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfb807b0 a3=1 items=0 ppid=5954 pid=6142 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null) >type=ANOM_PROMISCUOUS msg=audit(1221481525.730:7): dev=peth1 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1221481525.730:7): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bffda410 a3=1 items=0 ppid=5954 pid=6157 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null) >type=USER_AUTH msg=audit(1221481542.323:8): user pid=6521 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='PAM: authentication acct="?" : exe="/usr/sbin/gdm-binary" (hostname=?, addr=?, terminal=:0 res=failed)' >type=USER_LOGIN msg=audit(1221481542.323:9): user pid=6521 uid=0 auid=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='acct=rujo: exe="/usr/sbin/gdm-binary" (hostname=intel-mb, addr=192.168.2.134, terminal=:0 res=failed)' >type=USER_AUTH msg=audit(1221481547.391:10): user pid=6417 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' >type=USER_ACCT msg=audit(1221481547.391:11): user pid=6417 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' >type=LOGIN msg=audit(1221481547.415:12): login pid=6417 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1 >type=USER_ROLE_CHANGE msg=audit(1221481547.455:13): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=root:system_r:unconfined_t:s0-s0:c0.c1023 selected-context=root:system_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' >type=USER_START msg=audit(1221481547.455:14): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' >type=CRED_ACQ msg=audit(1221481547.455:15): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' >type=USER_LOGIN msg=audit(1221481547.455:16): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='uid=0: exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' >type=USER_LOGIN msg=audit(1221481597.854:17): user pid=6618 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1221481600.238:18): user pid=6618 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221481600.238:19): user pid=6618 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1221481600.279:20): user pid=6618 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1221481600.283:21): login pid=6618 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2 >type=USER_START msg=audit(1221481600.283:22): user pid=6618 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1221481600.283:23): user pid=6620 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1221481600.287:24): user pid=6618 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)' >type=USER_AUTH msg=audit(1221481605.355:25): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221481605.355:26): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1221481605.363:27): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1221481605.363:28): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_LOGIN msg=audit(1221482839.436:29): user pid=6706 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1221482841.200:30): user pid=6706 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221482841.200:31): user pid=6706 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1221482841.240:32): user pid=6706 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1221482841.240:33): login pid=6706 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=3 >type=USER_START msg=audit(1221482841.240:34): user pid=6706 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1221482841.244:35): user pid=6708 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1221482842.176:36): user pid=6706 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1221482842.180:37): user pid=6706 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221483661.495:38): user pid=6794 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221483661.495:39): user pid=6794 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221483661.495:40): login pid=6794 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4 >type=USER_START msg=audit(1221483661.523:41): user pid=6794 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221483661.563:42): user pid=6794 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221483661.563:43): user pid=6794 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_LOGIN msg=audit(1221484621.419:44): user pid=6856 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1221484623.515:45): user pid=6856 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221484623.519:46): user pid=6856 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1221484623.559:47): user pid=6856 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1221484623.559:48): login pid=6856 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=5 >type=USER_START msg=audit(1221484623.559:49): user pid=6856 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1221484623.563:50): user pid=6858 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1221484625.372:51): user pid=6856 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1221484625.372:52): user pid=6856 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1221485016.248:53): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' >type=USER_END msg=audit(1221485016.248:54): user pid=6417 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty1 res=success)' >type=CRED_DISP msg=audit(1221485019.232:55): user pid=6618 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1221485019.232:56): user pid=6618 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1221485019.236:57): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1221485019.236:58): user pid=6649 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=DAEMON_END msg=audit(1221485020.820:893): auditd normal halt, sending auid=4294967295 pid=8811 subj=system_u:system_r:initrc_t:s0 res=success >type=DAEMON_START msg=audit(1221485159.103:7301): auditd start, ver=1.6.5 format=raw kernel=2.6.18-115.el5xen auid=4294967295 pid=5038 res=success >type=CONFIG_CHANGE msg=audit(1221485159.199:4): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1 >type=CONFIG_CHANGE msg=audit(1221485159.207:5): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 >type=ANOM_PROMISCUOUS msg=audit(1221485177.965:6): dev=vif0.1 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1221485177.965:6): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf94bd80 a3=1 items=0 ppid=6002 pid=6190 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null) >type=ANOM_PROMISCUOUS msg=audit(1221485181.145:7): dev=peth1 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1221485181.145:7): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf9dde10 a3=1 items=0 ppid=6002 pid=6205 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null) >type=USER_LOGIN msg=audit(1221485208.458:8): user pid=6627 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1221485210.715:9): user pid=6627 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221485210.715:10): user pid=6627 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1221485210.759:11): user pid=6627 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1221485210.783:12): login pid=6627 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1 >type=USER_START msg=audit(1221485210.783:13): user pid=6627 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1221485210.787:14): user pid=6629 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1221485210.807:15): user pid=6627 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)' >type=USER_AUTH msg=audit(1221485216.507:16): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221485216.507:17): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1221485216.519:18): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1221485216.519:19): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_LOGIN msg=audit(1221486496.907:20): user pid=6720 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1221486499.083:21): user pid=6720 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221486499.083:22): user pid=6720 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1221486499.127:23): user pid=6720 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1221486499.127:24): login pid=6720 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=2 >type=USER_START msg=audit(1221486499.127:25): user pid=6720 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1221486499.127:26): user pid=6722 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1221486499.515:27): user pid=6720 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1221486499.519:28): user pid=6720 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1221487100.721:29): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1221487100.721:30): user pid=6659 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_LOGIN msg=audit(1221487134.563:31): user pid=6816 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1221487136.791:32): user pid=6816 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221487136.795:33): user pid=6816 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1221487136.835:34): user pid=6816 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1221487136.835:35): login pid=6816 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=3 >type=USER_START msg=audit(1221487136.835:36): user pid=6816 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1221487136.839:37): user pid=6819 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1221487136.979:38): user pid=6816 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1221487136.979:39): user pid=6816 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_AUTH msg=audit(1221487173.777:40): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221487173.781:41): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1221487173.781:42): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1221487173.781:43): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221487261.291:44): user pid=6885 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221487261.295:45): user pid=6885 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221487261.295:46): login pid=6885 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4 >type=USER_START msg=audit(1221487261.319:47): user pid=6885 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221487261.351:48): user pid=6885 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221487261.351:49): user pid=6885 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221487474.452:50): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1221487474.452:51): user pid=6857 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_AUTH msg=audit(1221487495.205:52): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221487495.205:53): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1221487495.205:54): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1221487495.205:55): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_DISP msg=audit(1221487684.245:56): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1221487684.249:57): user pid=7038 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_LOGIN msg=audit(1221488990.727:58): user pid=25328 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_ERR msg=audit(1221488990.999:59): user pid=25328 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: bad_ident acct="?" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=failed)' >type=USER_LOGIN msg=audit(1221488994.107:60): user pid=25330 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1221488995.999:61): user pid=25330 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221488995.999:62): user pid=25330 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1221488996.039:63): user pid=25330 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1221488996.039:64): login pid=25330 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=5 >type=USER_START msg=audit(1221488996.039:65): user pid=25330 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1221488996.043:66): user pid=25332 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1221488996.043:67): user pid=25330 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/2 res=success)' >type=USER_AUTH msg=audit(1221489501.043:68): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221489501.043:69): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1221489501.043:70): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1221489501.043:71): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=ANOM_ABEND msg=audit(1221489551.270:72): auid=500 uid=0 gid=0 ses=1 subj=user_u:system_r:unconfined_t:s0 pid=22936 comm="virsh" sig=11 >type=CRED_DISP msg=audit(1221489573.435:73): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1221489573.435:74): user pid=9808 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_AUTH msg=audit(1221489697.507:75): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221489697.507:76): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1221489697.511:77): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1221489697.511:78): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_DISP msg=audit(1221489734.829:79): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1221489734.833:80): user pid=19517 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221490861.592:81): user pid=19709 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221490861.592:82): user pid=19709 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221490861.592:83): login pid=19709 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6 >type=USER_START msg=audit(1221490861.620:84): user pid=19709 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221490861.624:85): user pid=19709 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221490861.624:86): user pid=19709 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221494461.849:87): user pid=19912 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221494461.849:88): user pid=19912 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221494461.849:89): login pid=19912 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7 >type=USER_START msg=audit(1221494461.869:90): user pid=19912 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221494461.873:91): user pid=19912 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221494461.873:92): user pid=19912 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221498061.098:93): user pid=20081 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221498061.098:94): user pid=20081 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221498061.098:95): login pid=20081 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8 >type=USER_START msg=audit(1221498061.118:96): user pid=20081 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221498061.122:97): user pid=20081 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221498061.122:98): user pid=20081 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221501661.347:99): user pid=20284 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221501661.347:100): user pid=20284 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221501661.347:101): login pid=20284 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=9 >type=USER_START msg=audit(1221501661.367:102): user pid=20284 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221501661.371:103): user pid=20284 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221501661.371:104): user pid=20284 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221505261.596:105): user pid=20453 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221505261.596:106): user pid=20453 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221505261.596:107): login pid=20453 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=10 >type=USER_START msg=audit(1221505261.616:108): user pid=20453 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221505261.620:109): user pid=20453 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221505261.620:110): user pid=20453 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221508861.845:111): user pid=20656 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221508861.845:112): user pid=20656 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221508861.845:113): login pid=20656 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=11 >type=USER_START msg=audit(1221508861.857:114): user pid=20656 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221508861.861:115): user pid=20656 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221508861.861:116): user pid=20656 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221512461.086:117): user pid=20859 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221512461.086:118): user pid=20859 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221512461.086:119): login pid=20859 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=12 >type=USER_START msg=audit(1221512461.106:120): user pid=20859 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221512461.110:121): user pid=20859 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221512461.110:122): user pid=20859 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221516061.335:123): user pid=21028 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221516061.335:124): user pid=21028 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221516061.335:125): login pid=21028 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=13 >type=USER_START msg=audit(1221516061.347:126): user pid=21028 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221516061.351:127): user pid=21028 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221516061.351:128): user pid=21028 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221519661.576:129): user pid=21231 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221519661.576:130): user pid=21231 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221519661.576:131): login pid=21231 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=14 >type=USER_START msg=audit(1221519661.596:132): user pid=21231 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221519661.600:133): user pid=21231 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221519661.600:134): user pid=21231 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221523261.825:135): user pid=21400 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221523261.825:136): user pid=21400 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221523261.825:137): login pid=21400 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=15 >type=USER_START msg=audit(1221523261.845:138): user pid=21400 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221523261.849:139): user pid=21400 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221523261.849:140): user pid=21400 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221526861.074:141): user pid=21603 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221526861.074:142): user pid=21603 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221526861.074:143): login pid=21603 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=16 >type=USER_START msg=audit(1221526861.094:144): user pid=21603 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221526861.098:145): user pid=21603 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221526861.098:146): user pid=21603 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221530461.323:147): user pid=21806 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221530461.323:148): user pid=21806 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221530461.323:149): login pid=21806 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=17 >type=USER_START msg=audit(1221530461.343:150): user pid=21806 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221530461.347:151): user pid=21806 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221530461.347:152): user pid=21806 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221534061.572:153): user pid=21975 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221534061.572:154): user pid=21975 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221534061.572:155): login pid=21975 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=18 >type=USER_START msg=audit(1221534061.584:156): user pid=21975 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221534061.588:157): user pid=21975 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221534061.588:158): user pid=21975 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221534121.591:159): user pid=21978 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221534121.591:160): user pid=21978 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221534121.591:161): login pid=21978 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=19 >type=USER_START msg=audit(1221534121.611:162): user pid=21978 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221534124.011:163): user pid=21978 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221534124.011:164): user pid=21978 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221537661.233:165): user pid=22793 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221537661.237:166): user pid=22793 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221537661.237:167): login pid=22793 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=20 >type=USER_START msg=audit(1221537661.265:168): user pid=22793 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221537661.269:169): user pid=22793 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221537661.269:170): user pid=22793 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221541261.494:171): user pid=22962 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221541261.494:172): user pid=22962 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221541261.494:173): login pid=22962 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=21 >type=USER_START msg=audit(1221541261.518:174): user pid=22962 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221541261.522:175): user pid=22962 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221541261.522:176): user pid=22962 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221544861.747:177): user pid=23165 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221544861.747:178): user pid=23165 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221544861.747:179): login pid=23165 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=22 >type=USER_START msg=audit(1221544861.759:180): user pid=23165 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221544861.759:181): user pid=23165 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221544861.763:182): user pid=23165 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221548461.988:183): user pid=23334 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221548461.988:184): user pid=23334 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221548461.988:185): login pid=23334 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=23 >type=USER_START msg=audit(1221548462.008:186): user pid=23334 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221548462.012:187): user pid=23334 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221548462.012:188): user pid=23334 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221552061.236:189): user pid=23537 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221552061.236:190): user pid=23537 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221552061.236:191): login pid=23537 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=24 >type=USER_START msg=audit(1221552061.248:192): user pid=23537 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221552061.252:193): user pid=23537 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221552061.252:194): user pid=23537 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221555661.477:195): user pid=23706 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221555661.477:196): user pid=23706 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221555661.477:197): login pid=23706 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=25 >type=USER_START msg=audit(1221555661.497:198): user pid=23706 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221555661.501:199): user pid=23706 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221555661.501:200): user pid=23706 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221559261.726:201): user pid=23909 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221559261.726:202): user pid=23909 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221559261.726:203): login pid=23909 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=26 >type=USER_START msg=audit(1221559261.738:204): user pid=23909 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221559261.742:205): user pid=23909 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221559261.742:206): user pid=23909 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221562861.967:207): user pid=24078 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221562861.967:208): user pid=24078 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221562861.967:209): login pid=24078 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=27 >type=USER_START msg=audit(1221562861.979:210): user pid=24078 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221562861.983:211): user pid=24078 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221562861.983:212): user pid=24078 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221566461.208:213): user pid=24281 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221566461.208:214): user pid=24281 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221566461.208:215): login pid=24281 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=28 >type=USER_START msg=audit(1221566461.220:216): user pid=24281 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221566461.224:217): user pid=24281 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221566461.224:218): user pid=24281 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221570061.449:219): user pid=24450 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221570061.449:220): user pid=24450 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221570061.449:221): login pid=24450 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=29 >type=USER_START msg=audit(1221570061.469:222): user pid=24450 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221570061.473:223): user pid=24450 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221570061.473:224): user pid=24450 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_LOGIN msg=audit(1221573537.215:225): user pid=24615 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.130, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1221573541.483:226): user pid=24615 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221573541.483:227): user pid=24615 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1221573541.527:228): user pid=24615 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)' >type=LOGIN msg=audit(1221573541.531:229): login pid=24615 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=30 >type=USER_START msg=audit(1221573541.531:230): user pid=24615 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1221573541.531:231): user pid=24617 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1221573541.559:232): user pid=24615 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=/dev/pts/3 res=success)' >type=USER_AUTH msg=audit(1221573615.524:233): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=USER_ACCT msg=audit(1221573615.524:234): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=USER_START msg=audit(1221573615.524:235): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=CRED_ACQ msg=audit(1221573615.524:236): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=CRED_DISP msg=audit(1221573647.814:237): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=USER_END msg=audit(1221573647.814:238): user pid=24652 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=USER_ACCT msg=audit(1221573661.698:239): user pid=24675 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221573661.698:240): user pid=24675 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221573661.698:241): login pid=24675 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=31 >type=USER_START msg=audit(1221573661.718:242): user pid=24675 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221573661.722:243): user pid=24675 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221573661.722:244): user pid=24675 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_AUTH msg=audit(1221573882.960:245): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=USER_ACCT msg=audit(1221573882.964:246): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=USER_START msg=audit(1221573882.964:247): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=CRED_ACQ msg=audit(1221573882.964:248): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=CRED_DISP msg=audit(1221574025.313:249): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=USER_END msg=audit(1221574025.317:250): user pid=24714 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)' >type=CRED_DISP msg=audit(1221574026.289:251): user pid=24615 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)' >type=USER_END msg=audit(1221574026.289:252): user pid=24615 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=koneko.home.annexia.org, addr=192.168.2.130, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221577261.947:253): user pid=24939 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221577261.947:254): user pid=24939 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221577261.947:255): login pid=24939 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=32 >type=USER_START msg=audit(1221577261.967:256): user pid=24939 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221577261.971:257): user pid=24939 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221577261.971:258): user pid=24939 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221580861.196:259): user pid=25108 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221580861.196:260): user pid=25108 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221580861.196:261): login pid=25108 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=33 >type=USER_START msg=audit(1221580861.216:262): user pid=25108 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221580861.220:263): user pid=25108 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221580861.220:264): user pid=25108 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221584461.445:265): user pid=25311 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221584461.445:266): user pid=25311 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221584461.445:267): login pid=25311 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=34 >type=USER_START msg=audit(1221584461.469:268): user pid=25311 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221584461.473:269): user pid=25311 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221584461.473:270): user pid=25311 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221588061.698:271): user pid=25518 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221588061.698:272): user pid=25518 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221588061.698:273): login pid=25518 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=35 >type=USER_START msg=audit(1221588061.718:274): user pid=25518 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221588061.722:275): user pid=25518 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221588061.722:276): user pid=25518 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221591661.947:277): user pid=25687 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221591661.947:278): user pid=25687 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221591661.947:279): login pid=25687 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=36 >type=USER_START msg=audit(1221591661.971:280): user pid=25687 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221591661.975:281): user pid=25687 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221591661.975:282): user pid=25687 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221595261.200:283): user pid=25890 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221595261.200:284): user pid=25890 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221595261.200:285): login pid=25890 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=37 >type=USER_START msg=audit(1221595261.220:286): user pid=25890 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221595261.224:287): user pid=25890 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221595261.224:288): user pid=25890 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221598861.449:289): user pid=26059 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221598861.449:290): user pid=26059 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221598861.449:291): login pid=26059 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=38 >type=USER_START msg=audit(1221598861.473:292): user pid=26059 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221598861.477:293): user pid=26059 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221598861.477:294): user pid=26059 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221602461.702:295): user pid=26228 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221602461.702:296): user pid=26228 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221602461.702:297): login pid=26228 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=39 >type=USER_START msg=audit(1221602461.722:298): user pid=26228 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221602461.726:299): user pid=26228 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221602461.726:300): user pid=26228 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221606061.951:301): user pid=26431 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221606061.951:302): user pid=26431 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221606061.951:303): login pid=26431 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=40 >type=USER_START msg=audit(1221606061.971:304): user pid=26431 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221606061.975:305): user pid=26431 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221606061.975:306): user pid=26431 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221609661.200:307): user pid=26634 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221609661.200:308): user pid=26634 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221609661.200:309): login pid=26634 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=41 >type=USER_START msg=audit(1221609661.220:310): user pid=26634 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221609661.224:311): user pid=26634 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221609661.224:312): user pid=26634 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221613261.449:313): user pid=26837 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221613261.449:314): user pid=26837 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221613261.449:315): login pid=26837 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=42 >type=USER_START msg=audit(1221613261.469:316): user pid=26837 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221613261.473:317): user pid=26837 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221613261.473:318): user pid=26837 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221616861.698:319): user pid=27006 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221616861.698:320): user pid=27006 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221616861.698:321): login pid=27006 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=43 >type=USER_START msg=audit(1221616861.718:322): user pid=27006 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221616861.722:323): user pid=27006 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221616861.722:324): user pid=27006 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221620461.947:325): user pid=27175 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221620461.947:326): user pid=27175 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221620461.947:327): login pid=27175 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=44 >type=USER_START msg=audit(1221620461.967:328): user pid=27175 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221620461.971:329): user pid=27175 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221620461.971:330): user pid=27175 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221620521.975:331): user pid=27178 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221620521.975:332): user pid=27178 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221620521.975:333): login pid=27178 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=45 >type=USER_START msg=audit(1221620521.995:334): user pid=27178 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221620529.003:335): user pid=27178 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221620529.003:336): user pid=27178 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221624061.224:337): user pid=27871 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221624061.228:338): user pid=27871 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221624061.228:339): login pid=27871 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=46 >type=USER_START msg=audit(1221624061.248:340): user pid=27871 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221624061.252:341): user pid=27871 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221624061.252:342): user pid=27871 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221627661.477:343): user pid=28040 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221627661.477:344): user pid=28040 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221627661.477:345): login pid=28040 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=47 >type=USER_START msg=audit(1221627661.497:346): user pid=28040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221627661.501:347): user pid=28040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221627661.501:348): user pid=28040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221631261.726:349): user pid=28243 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221631261.726:350): user pid=28243 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221631261.726:351): login pid=28243 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=48 >type=USER_START msg=audit(1221631261.746:352): user pid=28243 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221631261.750:353): user pid=28243 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221631261.750:354): user pid=28243 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221634861.975:355): user pid=28412 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221634861.975:356): user pid=28412 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221634861.975:357): login pid=28412 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=49 >type=USER_START msg=audit(1221634861.995:358): user pid=28412 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221634861.999:359): user pid=28412 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221634861.999:360): user pid=28412 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221638461.224:361): user pid=28614 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221638461.224:362): user pid=28614 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221638461.224:363): login pid=28614 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=50 >type=USER_START msg=audit(1221638461.244:364): user pid=28614 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221638461.248:365): user pid=28614 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221638461.248:366): user pid=28614 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_ACCT msg=audit(1221642061.473:367): user pid=28784 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221642061.473:368): user pid=28784 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221642061.473:369): login pid=28784 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=51 >type=USER_START msg=audit(1221642061.493:370): user pid=28784 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221642061.497:371): user pid=28784 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221642061.497:372): user pid=28784 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_AUTH msg=audit(1221645563.636:373): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221645563.636:374): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1221645563.640:375): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1221645563.640:376): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_DISP msg=audit(1221645623.112:377): user pid=25330 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1221645623.112:378): user pid=25330 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221645661.722:379): user pid=29018 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_ACQ msg=audit(1221645661.726:380): user pid=29018 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=LOGIN msg=audit(1221645661.726:381): login pid=29018 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=52 >type=USER_START msg=audit(1221645661.786:382): user pid=29018 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=CRED_DISP msg=audit(1221645661.790:383): user pid=29018 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_END msg=audit(1221645661.790:384): user pid=29018 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' >type=USER_CHAUTHTOK msg=audit(1221645731.594:385): user pid=29091 uid=0 auid=500 subj=user_u:system_r:useradd_t:s0 msg='op=adding user acct=dbus exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/1 res=failed)' >type=USER_CHAUTHTOK msg=audit(1221645765.149:386): user pid=29163 uid=0 auid=500 subj=user_u:system_r:useradd_t:s0 msg='op=adding user acct=sshd exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/1 res=failed)' >type=USER_CHAUTHTOK msg=audit(1221645781.894:387): user pid=29283 uid=0 auid=500 subj=user_u:system_r:useradd_t:s0 msg='op=adding user acct=rpcuser exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/1 res=failed)' >type=USER_CHAUTHTOK msg=audit(1221645790.774:388): user pid=29348 uid=0 auid=500 subj=user_u:system_r:groupadd_t:s0 msg='op=adding group acct=ntp exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=pts/1 res=failed)' >type=USER_CHAUTHTOK msg=audit(1221645790.778:389): user pid=29349 uid=0 auid=500 subj=user_u:system_r:useradd_t:s0 msg='op=adding user acct=ntp exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/1 res=failed)' >type=USER_CHAUTHTOK msg=audit(1221645792.834:390): user pid=29353 uid=0 auid=500 subj=user_u:system_r:groupadd_t:s0 msg='op=adding group acct=pcap exe="/usr/sbin/groupadd" (hostname=?, addr=?, terminal=pts/1 res=failed)' >type=USER_CHAUTHTOK msg=audit(1221645792.834:391): user pid=29354 uid=0 auid=500 subj=user_u:system_r:useradd_t:s0 msg='op=adding user acct=pcap exe="/usr/sbin/useradd" (hostname=?, addr=?, terminal=pts/1 res=failed)' >type=MAC_POLICY_LOAD msg=audit(1221645802.171:392): policy loaded auid=500 ses=1 >type=SYSCALL msg=audit(1221645802.171:392): arch=40000003 syscall=4 success=yes exit=1409762 a0=4 a1=b7e3a000 a2=1582e2 a3=bf88dde8 items=0 ppid=29367 pid=29368 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="load_policy" exe="/usr/sbin/load_policy" subj=user_u:system_r:load_policy_t:s0 key=(null) >type=USER_AVC msg=audit(1221645802.231:393): user pid=5207 uid=81 auid=4294967295 subj=system_u:system_r:system_dbusd_t:s0 msg='avc: received policyload notice (seqno=2) : exe="?" (sauid=81, hostname=?, addr=?, terminal=?)' >type=AVC msg=audit(1221645886.416:394): avc: denied { read } for pid=29880 comm="cupsd" name="tmp" dev=dm-4 ino=786630 scontext=user_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir >type=SYSCALL msg=audit(1221645886.416:394): arch=40000003 syscall=5 success=no exit=-13 a0=9b0a8a8 a1=18800 a2=2f2ba4 a3=9b1ac38 items=0 ppid=29879 pid=29880 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="cupsd" exe="/usr/sbin/cupsd" subj=user_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null) >type=CRED_DISP msg=audit(1221646042.790:395): user pid=6627 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1221646042.794:396): user pid=6627 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1221646042.798:397): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1221646042.798:398): user pid=28984 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=DAEMON_END msg=audit(1221646044.493:7302): auditd normal halt, sending auid=4294967295 pid=30712 subj=system_u:system_r:initrc_t:s0 res=success >type=DAEMON_START msg=audit(1221745534.741:5755): auditd start, ver=1.6.5 format=raw kernel=2.6.18-115.el5xen auid=4294967295 pid=2653 res=success >type=CONFIG_CHANGE msg=audit(1221745534.839:2): audit_enabled=1 old=0 by auid=4294967295 res=1 >type=CONFIG_CHANGE msg=audit(1221745534.847:3): audit_backlog_limit=320 old=64 by auid=4294967295 res=1 >type=ANOM_PROMISCUOUS msg=audit(1221745550.100:4): dev=vif0.1 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1221745550.100:4): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfe9d2d0 a3=1 items=0 ppid=3602 pid=3790 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" key=(null) >type=ANOM_PROMISCUOUS msg=audit(1221745553.300:5): dev=peth1 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1221745553.300:5): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf987dc0 a3=1 items=0 ppid=3602 pid=3805 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" key=(null) >type=USER_LOGIN msg=audit(1221745562.757:6): user pid=4222 uid=0 auid=4294967295 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1221745564.501:7): user pid=4222 uid=0 auid=4294967295 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221745564.501:8): user pid=4222 uid=0 auid=4294967295 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1221745564.501:9): user pid=4222 uid=0 auid=4294967295 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1221745564.521:10): login pid=4222 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1 >type=USER_START msg=audit(1221745564.525:11): user pid=4222 uid=0 auid=500 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1221745564.525:12): user pid=4224 uid=0 auid=500 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1221745564.557:13): user pid=4222 uid=0 auid=500 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)' >type=USER_AUTH msg=audit(1221746055.644:14): user pid=4273 uid=500 auid=500 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221746055.644:15): user pid=4273 uid=500 auid=500 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1221746055.684:16): user pid=4273 uid=500 auid=500 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1221746055.684:17): user pid=4273 uid=500 auid=500 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_DISP msg=audit(1221746073.469:18): user pid=4222 uid=0 auid=500 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1221746073.469:19): user pid=4222 uid=0 auid=500 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1221746073.473:20): user pid=4273 uid=500 auid=500 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1221746073.473:21): user pid=4273 uid=500 auid=500 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=DAEMON_END msg=audit(1221746074.765:5756): auditd normal halt, sending auid=4294967295 pid=4803 subj= res=success >type=DAEMON_START msg=audit(1221746264.707:2395): auditd start, ver=1.6.5 format=raw kernel=2.6.18-115.el5xen auid=4294967295 pid=2689 res=success >type=CONFIG_CHANGE msg=audit(1221746264.803:72): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1 >type=CONFIG_CHANGE msg=audit(1221746264.811:73): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 >type=AVC msg=audit(1221746268.715:74): avc: denied { read } for pid=3052 comm="cupsd" name="tmp" dev=dm-4 ino=786630 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir >type=SYSCALL msg=audit(1221746268.715:74): arch=40000003 syscall=5 success=yes exit=2 a0=88768a8 a1=18800 a2=7c2ba4 a3=8886c38 items=0 ppid=3051 pid=3052 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cupsd" exe="/usr/sbin/cupsd" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null) >type=USER_LOGIN msg=audit(1221746275.100:75): user pid=3312 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1221746276.984:76): user pid=3312 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221746276.984:77): user pid=3312 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1221746277.036:78): user pid=3312 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1221746277.036:79): login pid=3312 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1 >type=USER_START msg=audit(1221746277.036:80): user pid=3312 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1221746277.036:81): user pid=3333 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1221746277.076:82): user pid=3312 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)' >type=AVC msg=audit(1221746279.816:83): avc: denied { search } for pid=3674 comm="xenstored" name="/" dev=tmpfs ino=17787 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir >type=SYSCALL msg=audit(1221746279.816:83): arch=40000003 syscall=5 success=no exit=-2 a0=8fc1118 a1=8002 a2=0 a3=8002 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746279.816:84): avc: denied { write } for pid=3674 comm="xenstored" name="/" dev=tmpfs ino=17787 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir >type=AVC msg=audit(1221746279.816:84): avc: denied { add_name } for pid=3674 comm="xenstored" name="tdb" scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir >type=AVC msg=audit(1221746279.816:84): avc: denied { create } for pid=3674 comm="xenstored" name="tdb" scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746279.816:84): arch=40000003 syscall=5 success=yes exit=8 a0=8fc1118 a1=8042 a2=1a0 a3=8042 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746279.816:85): avc: denied { lock } for pid=3674 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=18118 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746279.816:85): arch=40000003 syscall=221 success=yes exit=0 a0=8 a1=e a2=bfef8074 a3=bfef8074 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746279.816:86): avc: denied { read } for pid=3674 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=18118 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746279.816:86): arch=40000003 syscall=3 success=yes exit=0 a0=8 a1=8fc1184 a2=a8 a3=804fe30 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746279.816:87): avc: denied { write } for pid=3674 comm="xenstored" name="tdb" dev=tmpfs ino=18118 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746279.816:87): arch=40000003 syscall=194 success=yes exit=0 a0=8 a1=0 a2=0 a3=8fc1168 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746279.816:88): avc: denied { getattr } for pid=3674 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=18118 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746279.816:88): arch=40000003 syscall=197 success=yes exit=0 a0=8 a1=bfef80d8 a2=50dff4 a3=0 items=0 ppid=3673 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746279.852:89): avc: denied { remove_name } for pid=3674 comm="xenstored" name="tdb.0x8fd0f50" dev=tmpfs ino=18122 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir >type=AVC msg=audit(1221746279.852:89): avc: denied { unlink } for pid=3674 comm="xenstored" name="tdb.0x8fd0f50" dev=tmpfs ino=18122 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746279.852:89): arch=40000003 syscall=10 success=yes exit=0 a0=8fd1c78 a1=1 a2=8fd0f50 a3=804e020 items=0 ppid=1 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746279.852:90): avc: denied { rename } for pid=3674 comm="xenstored" name="tdb.0x8fd0f50" dev=tmpfs ino=18123 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746279.852:90): arch=40000003 syscall=38 success=yes exit=0 a0=8fd1160 a1=805a3e0 a2=8fd20e0 a3=8fd0f50 items=0 ppid=1 pid=3674 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=ANOM_PROMISCUOUS msg=audit(1221746280.520:91): dev=vif0.1 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1221746280.520:91): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf9e6610 a3=1 items=0 ppid=3693 pid=3881 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null) >type=ANOM_PROMISCUOUS msg=audit(1221746283.716:92): dev=peth1 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1221746283.716:92): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfbaa7e0 a3=1 items=0 ppid=3693 pid=3896 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null) >type=USER_AUTH msg=audit(1221746339.172:93): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221746339.172:94): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1221746339.188:95): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1221746339.188:96): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_DISP msg=audit(1221746355.377:97): user pid=3312 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_END msg=audit(1221746355.377:98): user pid=3312 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session close acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_DISP msg=audit(1221746355.381:99): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_END msg=audit(1221746355.381:100): user pid=4316 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=DAEMON_END msg=audit(1221746356.962:2396): auditd normal halt, sending auid=4294967295 pid=4910 subj=system_u:system_r:initrc_t:s0 res=success >type=DAEMON_START msg=audit(1221746686.413:9898): auditd start, ver=1.6.5 format=raw kernel=2.6.18-115.el5xen auid=4294967295 pid=2664 res=success >type=CONFIG_CHANGE msg=audit(1221746686.512:7): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1 >type=CONFIG_CHANGE msg=audit(1221746686.520:8): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1 >type=AVC msg=audit(1221746691.684:9): avc: denied { read } for pid=3025 comm="cupsd" name="tmp" dev=dm-4 ino=786630 scontext=system_u:system_r:cupsd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir >type=SYSCALL msg=audit(1221746691.684:9): arch=40000003 syscall=5 success=yes exit=2 a0=89e78a8 a1=18800 a2=3f4ba4 a3=89f7c38 items=0 ppid=3024 pid=3025 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="cupsd" exe="/usr/sbin/cupsd" subj=system_u:system_r:cupsd_t:s0-s0:c0.c1023 key=(null) >type=AVC msg=audit(1221746704.853:10): avc: denied { search } for pid=3613 comm="xenstored" name="/" dev=tmpfs ino=11892 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir >type=SYSCALL msg=audit(1221746704.853:10): arch=40000003 syscall=5 success=no exit=-2 a0=8295118 a1=8002 a2=0 a3=8002 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746704.853:11): avc: denied { write } for pid=3613 comm="xenstored" name="/" dev=tmpfs ino=11892 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir >type=AVC msg=audit(1221746704.853:11): avc: denied { add_name } for pid=3613 comm="xenstored" name="tdb" scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir >type=AVC msg=audit(1221746704.853:11): avc: denied { create } for pid=3613 comm="xenstored" name="tdb" scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746704.853:11): arch=40000003 syscall=5 success=yes exit=8 a0=8295118 a1=8042 a2=1a0 a3=8042 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746704.853:12): avc: denied { lock } for pid=3613 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=12188 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746704.853:12): arch=40000003 syscall=221 success=yes exit=0 a0=8 a1=e a2=bffa9124 a3=bffa9124 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746704.853:13): avc: denied { read } for pid=3613 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=12188 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746704.853:13): arch=40000003 syscall=3 success=yes exit=0 a0=8 a1=8295184 a2=a8 a3=804fe30 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746704.853:14): avc: denied { write } for pid=3613 comm="xenstored" name="tdb" dev=tmpfs ino=12188 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746704.853:14): arch=40000003 syscall=194 success=yes exit=0 a0=8 a1=0 a2=0 a3=8295168 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746704.853:15): avc: denied { getattr } for pid=3613 comm="xenstored" path="/var/lib/xenstored/tdb" dev=tmpfs ino=12188 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746704.853:15): arch=40000003 syscall=197 success=yes exit=0 a0=8 a1=bffa9188 a2=50dff4 a3=0 items=0 ppid=3612 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746704.897:16): avc: denied { remove_name } for pid=3613 comm="xenstored" name="tdb.0x82a4da8" dev=tmpfs ino=12195 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=dir >type=AVC msg=audit(1221746704.897:16): avc: denied { unlink } for pid=3613 comm="xenstored" name="tdb.0x82a4da8" dev=tmpfs ino=12195 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746704.897:16): arch=40000003 syscall=10 success=yes exit=0 a0=82a5a10 a1=1 a2=82a4da8 a3=804e020 items=0 ppid=1 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=AVC msg=audit(1221746704.897:17): avc: denied { rename } for pid=3613 comm="xenstored" name="tdb.0x82a4da8" dev=tmpfs ino=12196 scontext=system_u:system_r:xenstored_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file >type=SYSCALL msg=audit(1221746704.897:17): arch=40000003 syscall=38 success=yes exit=0 a0=82a5cb0 a1=805a3e0 a2=82a4c68 a3=82a4da8 items=0 ppid=1 pid=3613 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="xenstored" exe="/usr/sbin/xenstored" subj=system_u:system_r:xenstored_t:s0 key=(null) >type=ANOM_PROMISCUOUS msg=audit(1221746705.693:18): dev=vif0.1 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1221746705.693:18): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bfa42670 a3=1 items=0 ppid=3632 pid=3820 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null) >type=ANOM_PROMISCUOUS msg=audit(1221746708.881:19): dev=peth1 prom=256 old_prom=0 auid=4294967295 ses=4294967295 >type=SYSCALL msg=audit(1221746708.881:19): arch=40000003 syscall=54 success=yes exit=0 a0=3 a1=89a2 a2=bf8d0d00 a3=1 items=0 ppid=3632 pid=3835 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="brctl" exe="/usr/sbin/brctl" subj=system_u:system_r:xend_t:s0 key=(null) >type=USER_LOGIN msg=audit(1221746719.366:20): user pid=4249 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='acct="rjones": exe="/usr/sbin/sshd" (hostname=?, addr=192.168.2.128, terminal=sshd res=failed)' >type=USER_AUTH msg=audit(1221746721.002:21): user pid=4249 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: authentication acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_ACCT msg=audit(1221746721.002:22): user pid=4249 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: accounting acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_ACQ msg=audit(1221746721.046:23): user pid=4249 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=LOGIN msg=audit(1221746721.054:24): login pid=4249 uid=0 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1 >type=USER_START msg=audit(1221746721.058:25): user pid=4249 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: session open acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=CRED_REFR msg=audit(1221746721.058:26): user pid=4251 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='PAM: setcred acct="rjones" : exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=ssh res=success)' >type=USER_LOGIN msg=audit(1221746721.114:27): user pid=4249 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c1023 msg='uid=500: exe="/usr/sbin/sshd" (hostname=amd.home.annexia.org, addr=192.168.2.128, terminal=/dev/pts/1 res=success)' >type=USER_AUTH msg=audit(1221746724.062:28): user pid=4281 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_ACCT msg=audit(1221746724.062:29): user pid=4281 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=USER_START msg=audit(1221746724.094:30): user pid=4281 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)' >type=CRED_ACQ msg=audit(1221746724.094:31): user pid=4281 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct="root" : exe="/bin/su" (hostname=?, addr=?, terminal=pts/1 res=success)'
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Raw
Actions:
View
Attachments on
bug 462702
:
317084
| 317085 |
317102
|
317127
|
317172
|
317180