Attachment 573920 Details for Bug 808368 – audit.log from the affected system

audit.log from the affected system

audit.log (text/x-log), 93.23 KB, created by Fabian Deutsch on 2012-03-30 09:28:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Fabian Deutsch

Created: 2012-03-30 09:28:52 UTC

Size: 93.23 KB

patch

obsolete

>type=DAEMON_START msg=audit(1333035399.380:6038): auditd start, ver=2.2 format=raw kernel=2.6.32-257.el6.x86_64 auid=4294967295 pid=1814 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1333035399.493:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_ABEND msg=audit(1333035400.498:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:irqbalance_t:s0 pid=1858 comm="irqbalance" sig=6
>type=NETFILTER_CFG msg=audit(1333035401.041:6): table=filter family=10 entries=0
>type=NETFILTER_CFG msg=audit(1333035401.041:6): table=filter family=2 entries=0
>type=SYSCALL msg=audit(1333035401.041:6): arch=c000003e syscall=56 success=yes exit=1983 a0=6c020011 a1=7f928411e160 a2=8 a3=a7373 items=0 ppid=1 pid=1949 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=SYSCALL msg=audit(1333035401.041:7): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7f928411e160 a2=8 a3=a7373 items=0 ppid=1949 pid=1983 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=FD_PAIR msg=audit(1333035401.041:7): fd0=0 fd1=0
>type=AVC msg=audit(1333035402.152:8): avc:  denied  { chown } for  pid=2097 comm="wdmd" capability=0  scontext=system_u:system_r:wdmd_t:s0 tcontext=system_u:system_r:wdmd_t:s0 tclass=capability
>type=SYSCALL msg=audit(1333035402.152:8): arch=c000003e syscall=92 success=yes exit=0 a0=7fffde116a42 a1=ffffffff a2=b3 a3=fffffff7 items=0 ppid=1 pid=2097 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="wdmd" exe="/usr/sbin/wdmd" subj=system_u:system_r:wdmd_t:s0 key=(null)
>type=USER_START msg=audit(1333035402.904:9): user pid=2144 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_ACQ msg=audit(1333035402.904:10): user pid=2144 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_DISP msg=audit(1333035402.918:11): user pid=2144 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=USER_END msg=audit(1333035402.918:12): user pid=2144 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=FS_RELABEL msg=audit(1333035408.260:13): user pid=2196 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:setfiles_t:s0 msg='op=mass relabel exe="/sbin/setfiles" hostname=? addr=? terminal=console res=success'
>type=SYSTEM_RUNLEVEL msg=audit(1333035416.304:14): user pid=2226 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:apmd_t:s0 msg='old-level=3 new-level=0 exe="/sbin/shutdown" hostname=? addr=? terminal=? res=success'
>type=SYSTEM_SHUTDOWN msg=audit(1333035416.304:15): user pid=2226 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:apmd_t:s0 msg='init exe="/sbin/shutdown" hostname=? addr=? terminal=? res=success'
>type=DAEMON_START msg=audit(1333035489.618:9303): auditd start, ver=2.2 format=raw kernel=2.6.32-257.el6.x86_64 auid=4294967295 pid=1786 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1333035489.730:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_ABEND msg=audit(1333035490.642:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:irqbalance_t:s0 pid=1830 comm="irqbalance" sig=6
>type=NETFILTER_CFG msg=audit(1333035491.147:6): table=filter family=10 entries=0
>type=NETFILTER_CFG msg=audit(1333035491.147:6): table=filter family=2 entries=0
>type=SYSCALL msg=audit(1333035491.147:6): arch=c000003e syscall=56 success=yes exit=1960 a0=6c020011 a1=7f0e300e7da0 a2=8 a3=a7373 items=0 ppid=1 pid=1923 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=SYSCALL msg=audit(1333035491.147:7): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7f0e300e7da0 a2=8 a3=a7373 items=0 ppid=1923 pid=1960 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=FD_PAIR msg=audit(1333035491.147:7): fd0=0 fd1=0
>type=AVC msg=audit(1333035492.161:8): avc:  denied  { chown } for  pid=2066 comm="wdmd" capability=0  scontext=system_u:system_r:wdmd_t:s0 tcontext=system_u:system_r:wdmd_t:s0 tclass=capability
>type=SYSCALL msg=audit(1333035492.161:8): arch=c000003e syscall=92 success=yes exit=0 a0=7fff9d9d6072 a1=ffffffff a2=b3 a3=fffffff7 items=0 ppid=1 pid=2066 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="wdmd" exe="/usr/sbin/wdmd" subj=system_u:system_r:wdmd_t:s0 key=(null)
>type=USER_START msg=audit(1333035492.873:9): user pid=2113 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_ACQ msg=audit(1333035492.874:10): user pid=2113 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_DISP msg=audit(1333035492.887:11): user pid=2113 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=USER_END msg=audit(1333035492.888:12): user pid=2113 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=NETFILTER_CFG msg=audit(1333035494.130:13): table=filter family=10 entries=0
>type=NETFILTER_CFG msg=audit(1333035494.130:13): table=filter family=2 entries=0
>type=SYSCALL msg=audit(1333035494.130:13): arch=c000003e syscall=56 success=yes exit=2312 a0=6c020011 a1=7f64d0111850 a2=8 a3=a7373 items=0 ppid=1 pid=2299 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=SYSCALL msg=audit(1333035494.130:14): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7f64d0111850 a2=8 a3=a7373 items=0 ppid=2299 pid=2312 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=FD_PAIR msg=audit(1333035494.130:14): fd0=0 fd1=0
>type=USER_AUTH msg=audit(1333035514.173:15): user pid=2280 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1333035514.176:16): user pid=2280 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=LOGIN msg=audit(1333035514.177:17): pid=2280 uid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1333035514.232:18): user pid=2280 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_START msg=audit(1333035514.246:19): user pid=2280 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1333035514.246:20): user pid=2280 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_LOGIN msg=audit(1333035514.247:21): user pid=2280 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=500 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_CMD msg=audit(1333035514.317:22): user pid=2327 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/admin" cmd=646D657367202D6E2031 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1333035514.320:23): user pid=2328 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1333035514.322:24): user pid=2328 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_CMD msg=audit(1333035514.337:25): user pid=2332 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/admin" cmd="/usr/libexec/ovirt-config-setup" terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1333035514.339:26): user pid=2333 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1333035514.339:27): user pid=2333 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=AVC msg=audit(1333035514.986:28): avc:  denied  { write } for  pid=2353 comm="passwd" path=2F746D702F666669477253393076202864656C6574656429 dev=tmpfs ino=17869 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1333035514.986:28): arch=c000003e syscall=59 success=yes exit=0 a0=1de11a0 a1=1de1760 a2=1de0250 a3=7fffe96bdf60 items=0 ppid=2333 pid=2353 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=1 comm="passwd" exe="/usr/bin/passwd" subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 key=(null)
>type=USER_CHAUTHTOK msg=audit(1333035515.001:29): user pid=2353 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=password status displayed for user id=500 exe="/usr/bin/passwd" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1333035601.585:30): user pid=2375 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333035601.585:31): user pid=2374 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333035601.585:32): user pid=2375 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333035601.585:33): user pid=2371 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333035601.585:34): user pid=2372 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333035601.585:35): user pid=2373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333035601.585:36): user pid=2373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333035601.585:37): user pid=2371 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333035601.587:38): user pid=2372 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333035601.592:41): pid=2375 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=LOGIN msg=audit(1333035601.592:39): pid=2371 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=LOGIN msg=audit(1333035601.592:40): pid=2373 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=CRED_ACQ msg=audit(1333035601.592:42): user pid=2374 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333035601.592:43): pid=2374 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=LOGIN msg=audit(1333035601.593:44): pid=2372 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_START msg=audit(1333035601.597:45): user pid=2372 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333035601.597:46): user pid=2371 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333035601.598:47): user pid=2375 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333035601.599:48): user pid=2373 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333035601.599:49): user pid=2374 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333035601.664:50): user pid=2374 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333035601.664:51): user pid=2375 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333035601.664:52): user pid=2374 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333035601.664:53): user pid=2375 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333035601.665:54): user pid=2372 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333035601.665:55): user pid=2372 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333035601.728:56): user pid=2373 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333035601.728:57): user pid=2373 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333035601.874:58): user pid=2371 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333035601.874:59): user pid=2371 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333035721.898:60): user pid=2411 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333035721.898:61): user pid=2411 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333035721.899:62): pid=2411 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_START msg=audit(1333035721.908:63): user pid=2411 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333035722.085:64): user pid=2411 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333035722.085:65): user pid=2411 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333035841.091:66): user pid=2435 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333035841.092:67): user pid=2435 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333035841.092:68): pid=2435 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
>type=USER_START msg=audit(1333035841.098:69): user pid=2435 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333035841.243:70): user pid=2435 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333035841.244:71): user pid=2435 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=SYSTEM_RUNLEVEL msg=audit(1333035958.075:72): user pid=2459 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0 exe="/sbin/telinit" hostname=? addr=? terminal=tty1 res=success'
>type=SYSTEM_SHUTDOWN msg=audit(1333035958.075:73): user pid=2459 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='init exe="/sbin/telinit" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_DISP msg=audit(1333035958.093:74): user pid=2280 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_END msg=audit(1333035958.099:75): user pid=2280 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1333035958.620:76): user pid=2004 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=77:2f:37:dd:ee:aa:e0:f3:28:23:11:8a:84:99:35:eb direction=? spid=2004 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1333035958.620:77): user pid=2004 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:97:9c:4f:06:ff:ca:e6:5e:69:58:90:28:72:df:37 direction=? spid=2004 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=DAEMON_END msg=audit(1333035959.224:9304): auditd normal halt, sending auid=0 pid=2561 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1333035994.823:9621): auditd start, ver=2.2 format=raw kernel=2.6.32-257.el6.x86_64 auid=4294967295 pid=1805 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1333035994.937:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_ABEND msg=audit(1333035995.877:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:irqbalance_t:s0 pid=1849 comm="irqbalance" sig=6
>type=NETFILTER_CFG msg=audit(1333035996.976:6): table=filter family=10 entries=0
>type=NETFILTER_CFG msg=audit(1333035996.976:6): table=filter family=2 entries=0
>type=SYSCALL msg=audit(1333035996.976:6): arch=c000003e syscall=56 success=yes exit=2072 a0=6c020011 a1=7ff6900e6f90 a2=8 a3=a7373 items=0 ppid=1 pid=2003 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=SYSCALL msg=audit(1333035996.976:7): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7ff6900e6f90 a2=8 a3=a7373 items=0 ppid=2003 pid=2072 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=FD_PAIR msg=audit(1333035996.976:7): fd0=0 fd1=0
>type=AVC msg=audit(1333035997.419:8): avc:  denied  { chown } for  pid=2085 comm="wdmd" capability=0  scontext=system_u:system_r:wdmd_t:s0 tcontext=system_u:system_r:wdmd_t:s0 tclass=capability
>type=SYSCALL msg=audit(1333035997.419:8): arch=c000003e syscall=92 success=yes exit=0 a0=7fffb8be16e2 a1=ffffffff a2=b3 a3=fffffff7 items=0 ppid=1 pid=2085 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="wdmd" exe="/usr/sbin/wdmd" subj=system_u:system_r:wdmd_t:s0 key=(null)
>type=USER_START msg=audit(1333035998.126:9): user pid=2132 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_ACQ msg=audit(1333035998.126:10): user pid=2132 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_DISP msg=audit(1333035998.141:11): user pid=2132 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=USER_END msg=audit(1333035998.145:12): user pid=2132 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=USER_AUTH msg=audit(1333036008.827:13): user pid=2224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1333036008.829:14): user pid=2224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=LOGIN msg=audit(1333036008.830:15): pid=2224 uid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 old auid=4294967295 new auid=500 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1333036008.889:16): user pid=2224 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_START msg=audit(1333036008.901:17): user pid=2224 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1333036008.901:18): user pid=2224 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_LOGIN msg=audit(1333036008.902:19): user pid=2224 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=500 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_CMD msg=audit(1333036008.967:20): user pid=2255 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/admin" cmd=646D657367202D6E2031 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1333036008.969:21): user pid=2256 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1333036008.970:22): user pid=2256 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_CMD msg=audit(1333036008.984:23): user pid=2260 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/admin" cmd="/usr/libexec/ovirt-config-setup" terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1333036008.985:24): user pid=2261 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1333036008.985:25): user pid=2261 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=AVC msg=audit(1333036009.638:26): avc:  denied  { write } for  pid=2281 comm="passwd" path=2F746D702F666669467970547752202864656C6574656429 dev=tmpfs ino=17727 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1333036009.638:26): arch=c000003e syscall=59 success=yes exit=0 a0=1ff21a0 a1=1ff2760 a2=1ff1250 a3=7fff79424690 items=0 ppid=2261 pid=2281 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=1 comm="passwd" exe="/usr/bin/passwd" subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 key=(null)
>type=USER_CHAUTHTOK msg=audit(1333036009.655:27): user pid=2281 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=password status displayed for user id=500 exe="/usr/bin/passwd" hostname=? addr=? terminal=tty1 res=success'
>type=AVC msg=audit(1333036013.402:28): avc:  denied  { read write } for  pid=2284 comm="shutdown" path=2F746D702F666669467970547752202864656C6574656429 dev=tmpfs ino=17727 scontext=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1333036013.402:28): arch=c000003e syscall=59 success=yes exit=0 a0=19d2250 a1=19d2570 a2=19d1260 a3=7fff0b005680 items=0 ppid=2282 pid=2284 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=1 comm="shutdown" exe="/sbin/shutdown" subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 key=(null)
>type=SYSTEM_RUNLEVEL msg=audit(1333036013.414:29): user pid=2284 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0 exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
>type=SYSTEM_SHUTDOWN msg=audit(1333036013.414:30): user pid=2284 uid=0 auid=500 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
>type=AVC msg=audit(1333036013.433:31): avc:  denied  { signal } for  pid=2224 comm="login" scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1333036013.433:31): arch=c000003e syscall=62 success=yes exit=0 a0=fffff73c a1=f a2=7fff60060080 a3=7fff6005fdf0 items=0 ppid=1 pid=2224 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1333036013.434:32): avc:  denied  { signal } for  pid=2224 comm="login" scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 tclass=process
>type=SYSCALL msg=audit(1333036013.434:32): arch=c000003e syscall=62 success=yes exit=0 a0=fffff73c a1=1 a2=7fff60060080 a3=7fff6005fdf0 items=0 ppid=1 pid=2224 auid=500 uid=0 gid=500 euid=0 suid=0 fsuid=0 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="login" exe="/bin/login" subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 key=(null)
>type=CRED_DISP msg=audit(1333036013.434:33): user pid=2224 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_END msg=audit(1333036013.438:34): user pid=2224 uid=0 auid=500 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1333036013.939:35): user pid=2007 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=77:2f:37:dd:ee:aa:e0:f3:28:23:11:8a:84:99:35:eb direction=? spid=2007 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1333036013.939:36): user pid=2007 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:97:9c:4f:06:ff:ca:e6:5e:69:58:90:28:72:df:37 direction=? spid=2007 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=DAEMON_END msg=audit(1333036014.541:9622): auditd normal halt, sending auid=0 pid=2387 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1333036172.688:9515): auditd start, ver=2.2 format=raw kernel=2.6.32-257.el6.x86_64 auid=4294967295 pid=1803 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1333036172.800:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_ABEND msg=audit(1333036173.724:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:irqbalance_t:s0 pid=1847 comm="irqbalance" sig=6
>type=NETFILTER_CFG msg=audit(1333036174.788:6): table=filter family=10 entries=0
>type=NETFILTER_CFG msg=audit(1333036174.788:6): table=filter family=2 entries=0
>type=SYSCALL msg=audit(1333036174.788:6): arch=c000003e syscall=56 success=yes exit=2055 a0=6c020011 a1=7fb0d011bcb0 a2=8 a3=a7373 items=0 ppid=1 pid=1995 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=SYSCALL msg=audit(1333036174.788:7): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7fb0d011bcb0 a2=8 a3=a7373 items=0 ppid=1995 pid=2055 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=FD_PAIR msg=audit(1333036174.788:7): fd0=0 fd1=0
>type=AVC msg=audit(1333036175.529:8): avc:  denied  { chown } for  pid=2083 comm="wdmd" capability=0  scontext=system_u:system_r:wdmd_t:s0 tcontext=system_u:system_r:wdmd_t:s0 tclass=capability
>type=SYSCALL msg=audit(1333036175.529:8): arch=c000003e syscall=92 success=yes exit=0 a0=7fffec9c1572 a1=ffffffff a2=b3 a3=fffffff7 items=0 ppid=1 pid=2083 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="wdmd" exe="/usr/sbin/wdmd" subj=system_u:system_r:wdmd_t:s0 key=(null)
>type=USER_START msg=audit(1333036176.257:9): user pid=2130 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_ACQ msg=audit(1333036176.257:10): user pid=2130 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_DISP msg=audit(1333036176.271:11): user pid=2130 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=USER_END msg=audit(1333036176.271:12): user pid=2130 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=USER_ACCT msg=audit(1333036201.912:13): user pid=2243 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333036201.912:14): user pid=2244 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333036201.912:15): user pid=2242 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333036201.912:16): user pid=2244 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333036201.912:17): user pid=2242 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333036201.912:18): user pid=2243 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333036201.914:19): pid=2244 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=LOGIN msg=audit(1333036201.914:20): pid=2243 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_ACCT msg=audit(1333036201.915:21): user pid=2241 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333036201.915:22): pid=2242 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=CRED_ACQ msg=audit(1333036201.915:23): user pid=2241 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333036201.916:24): pid=2241 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1333036201.917:25): user pid=2243 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333036201.917:26): user pid=2242 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333036201.920:27): user pid=2244 uid=0 auid=0 ses=1 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333036201.920:28): user pid=2241 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036201.968:29): user pid=2244 uid=0 auid=0 ses=1 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036201.968:30): user pid=2243 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036201.968:31): user pid=2243 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036201.968:32): user pid=2244 uid=0 auid=0 ses=1 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036202.008:33): user pid=2242 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036202.008:34): user pid=2242 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036202.176:35): user pid=2241 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036202.177:36): user pid=2241 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333036321.187:37): user pid=2274 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333036321.187:38): user pid=2274 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333036321.191:39): pid=2274 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1333036321.196:40): user pid=2274 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036321.331:41): user pid=2274 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036321.332:42): user pid=2274 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333036441.338:43): user pid=2298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333036441.338:44): user pid=2298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333036441.338:45): pid=2298 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_START msg=audit(1333036441.347:46): user pid=2298 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036441.475:47): user pid=2298 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036441.475:48): user pid=2298 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333036501.480:49): user pid=2316 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333036501.481:50): user pid=2316 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333036501.481:51): pid=2316 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_START msg=audit(1333036501.487:52): user pid=2316 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036501.494:53): user pid=2316 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036501.494:54): user pid=2316 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333036561.499:55): user pid=2325 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333036561.499:56): user pid=2325 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333036561.499:57): pid=2325 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
>type=USER_START msg=audit(1333036561.508:58): user pid=2325 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036561.640:59): user pid=2325 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036561.640:60): user pid=2325 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333036681.646:61): user pid=2349 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333036681.646:62): user pid=2349 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333036681.646:63): pid=2349 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=9
>type=USER_START msg=audit(1333036681.651:64): user pid=2349 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036681.795:65): user pid=2349 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036681.795:66): user pid=2349 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333036801.803:67): user pid=2373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333036801.803:68): user pid=2374 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333036801.803:69): user pid=2374 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333036801.803:70): user pid=2373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333036801.803:72): pid=2373 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=10
>type=LOGIN msg=audit(1333036801.803:71): pid=2374 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=11
>type=USER_ACCT msg=audit(1333036801.808:73): user pid=2376 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333036801.808:74): user pid=2376 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333036801.809:75): user pid=2375 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333036801.809:76): pid=2376 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=12
>type=CRED_ACQ msg=audit(1333036801.809:77): user pid=2375 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333036801.809:78): pid=2375 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=13
>type=USER_START msg=audit(1333036801.813:79): user pid=2373 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333036801.814:80): user pid=2374 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333036801.816:81): user pid=2375 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333036801.816:82): user pid=2376 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036801.822:83): user pid=2376 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036801.823:84): user pid=2375 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036801.823:85): user pid=2376 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036801.823:86): user pid=2375 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036801.963:87): user pid=2373 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036801.964:88): user pid=2373 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333036802.026:89): user pid=2374 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333036802.026:90): user pid=2374 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=SYSTEM_RUNLEVEL msg=audit(1333036821.655:91): user pid=2398 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:apmd_t:s0 msg='old-level=3 new-level=0 exe="/sbin/shutdown" hostname=? addr=? terminal=? res=success'
>type=SYSTEM_SHUTDOWN msg=audit(1333036821.655:92): user pid=2398 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:apmd_t:s0 msg='init exe="/sbin/shutdown" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1333036822.169:93): user pid=2005 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=77:2f:37:dd:ee:aa:e0:f3:28:23:11:8a:84:99:35:eb direction=? spid=2005 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1333036822.169:94): user pid=2005 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:97:9c:4f:06:ff:ca:e6:5e:69:58:90:28:72:df:37 direction=? spid=2005 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=DAEMON_END msg=audit(1333036822.786:9516): auditd normal halt, sending auid=0 pid=2501 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1333096453.992:1253): auditd start, ver=2.2 format=raw kernel=2.6.32-257.el6.x86_64 auid=4294967295 pid=1779 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1333096454.113:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=ANOM_ABEND msg=audit(1333096456.191:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:irqbalance_t:s0 pid=1823 comm="irqbalance" sig=6
>type=NETFILTER_CFG msg=audit(1333096457.444:6): table=filter family=10 entries=0
>type=NETFILTER_CFG msg=audit(1333096457.444:6): table=filter family=2 entries=0
>type=SYSCALL msg=audit(1333096457.444:7): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7f4d00074440 a2=8 a3=a7373 items=0 ppid=1967 pid=2012 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=FD_PAIR msg=audit(1333096457.444:7): fd0=0 fd1=0
>type=SYSCALL msg=audit(1333096457.444:6): arch=c000003e syscall=56 success=yes exit=2012 a0=6c020011 a1=7f4d00074440 a2=8 a3=a7373 items=0 ppid=1 pid=1967 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1333096458.147:8): avc:  denied  { chown } for  pid=2060 comm="wdmd" capability=0  scontext=system_u:system_r:wdmd_t:s0 tcontext=system_u:system_r:wdmd_t:s0 tclass=capability
>type=SYSCALL msg=audit(1333096458.147:8): arch=c000003e syscall=92 success=yes exit=0 a0=7fff0969be72 a1=ffffffff a2=b3 a3=fffffff7 items=0 ppid=1 pid=2060 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="wdmd" exe="/usr/sbin/wdmd" subj=system_u:system_r:wdmd_t:s0 key=(null)
>type=USER_START msg=audit(1333096459.005:9): user pid=2107 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_ACQ msg=audit(1333096459.005:10): user pid=2107 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_DISP msg=audit(1333096459.020:11): user pid=2107 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=USER_END msg=audit(1333096459.020:12): user pid=2107 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="sanlock" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=USER_ACCT msg=audit(1333096561.568:13): user pid=2224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333096561.568:14): user pid=2224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333096561.570:15): pid=2224 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_START msg=audit(1333096561.578:16): user pid=2224 uid=0 auid=0 ses=1 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333096561.938:17): user pid=2224 uid=0 auid=0 ses=1 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333096561.938:18): user pid=2224 uid=0 auid=0 ses=1 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333096681.945:19): user pid=2248 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333096681.945:20): user pid=2248 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333096681.945:21): pid=2248 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1333096681.949:22): user pid=2248 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333096682.091:23): user pid=2248 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333096682.092:24): user pid=2248 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333096801.099:25): user pid=2274 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333096801.100:26): user pid=2274 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333096801.100:27): user pid=2275 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333096801.100:28): pid=2274 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=CRED_ACQ msg=audit(1333096801.101:29): user pid=2275 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333096801.101:30): user pid=2276 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333096801.101:31): user pid=2276 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333096801.101:32): pid=2275 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=LOGIN msg=audit(1333096801.101:33): pid=2276 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_ACCT msg=audit(1333096801.102:34): user pid=2272 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333096801.102:35): user pid=2272 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333096801.102:36): pid=2272 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_ACCT msg=audit(1333096801.103:37): user pid=2273 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333096801.104:38): user pid=2273 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333096801.104:39): pid=2273 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_START msg=audit(1333096801.104:40): user pid=2276 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333096801.107:41): user pid=2274 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333096801.107:42): user pid=2275 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333096801.109:43): user pid=2272 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333096801.113:44): user pid=2273 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333096801.120:45): user pid=2276 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333096801.120:46): user pid=2276 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333096801.121:47): user pid=2275 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333096801.121:48): user pid=2275 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333096801.202:49): user pid=2273 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333096801.202:50): user pid=2273 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333096801.248:51): user pid=2272 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333096801.248:52): user pid=2272 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333096801.260:53): user pid=2274 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333096801.260:54): user pid=2274 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333096921.269:55): user pid=2308 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333096921.269:56): user pid=2308 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333096921.273:57): pid=2308 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
>type=USER_START msg=audit(1333096921.279:58): user pid=2308 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333096921.410:59): user pid=2308 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333096921.410:60): user pid=2308 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_AUTH msg=audit(1333096955.069:61): user pid=2199 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1333096955.073:62): user pid=2199 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=LOGIN msg=audit(1333096955.073:63): pid=2199 uid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 old auid=4294967295 new auid=500 old ses=4294967295 new ses=9
>type=USER_ROLE_CHANGE msg=audit(1333096955.135:64): user pid=2199 uid=0 auid=500 ses=9 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_START msg=audit(1333096955.148:65): user pid=2199 uid=0 auid=500 ses=9 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1333096955.149:66): user pid=2199 uid=0 auid=500 ses=9 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="admin" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_LOGIN msg=audit(1333096955.150:67): user pid=2199 uid=0 auid=500 ses=9 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=500 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_CMD msg=audit(1333096955.291:68): user pid=2340 uid=0 auid=500 ses=9 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/admin" cmd=646D657367202D6E2031 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1333096955.293:69): user pid=2341 uid=0 auid=500 ses=9 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1333096955.296:70): user pid=2341 uid=0 auid=500 ses=9 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_CMD msg=audit(1333096955.312:71): user pid=2345 uid=0 auid=500 ses=9 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/admin" cmd="/usr/libexec/ovirt-config-setup" terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1333096955.314:72): user pid=2346 uid=0 auid=500 ses=9 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1333096955.314:73): user pid=2346 uid=0 auid=500 ses=9 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=AVC msg=audit(1333096956.024:74): avc:  denied  { write } for  pid=2366 comm="passwd" path=2F746D702F66666939504E4A7944202864656C6574656429 dev=tmpfs ino=18477 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1333096956.024:74): arch=c000003e syscall=59 success=yes exit=0 a0=13ab1a0 a1=13ab760 a2=13aa250 a3=7fffc211e200 items=0 ppid=2346 pid=2366 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=9 comm="passwd" exe="/usr/bin/passwd" subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 key=(null)
>type=USER_CHAUTHTOK msg=audit(1333096956.042:75): user pid=2366 uid=0 auid=500 ses=9 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=password status displayed for user id=500 exe="/usr/bin/passwd" hostname=? addr=? terminal=tty1 res=success'
>type=ANOM_PROMISCUOUS msg=audit(1333096972.286:76): dev=eth0 prom=256 old_prom=0 auid=500 uid=0 gid=0 ses=9
>type=SYSCALL msg=audit(1333096972.286:76): arch=c000003e syscall=16 success=yes exit=0 a0=3 a1=89a2 a2=7fff48904400 a3=7fff48904150 items=0 ppid=2676 pid=2703 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=9 comm="brctl" exe="/usr/sbin/brctl" subj=unconfined_u:system_r:brctl_t:s0 key=(null)
>type=AVC msg=audit(1333096972.354:77): avc:  denied  { append } for  pid=2732 comm="consoletype" path="/var/log/ovirt.log" dev=dm-3 ino=31 scontext=unconfined_u:system_r:consoletype_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1333096972.354:77): arch=c000003e syscall=59 success=yes exit=0 a0=20f12b0 a1=20f11d0 a2=20f4b10 a3=7fff582d4df0 items=0 ppid=2731 pid=2732 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=9 comm="consoletype" exe="/sbin/consoletype" subj=unconfined_u:system_r:consoletype_t:s0 key=(null)
>type=AVC msg=audit(1333096976.598:78): avc:  denied  { append } for  pid=2745 comm="consoletype" path="/var/log/ovirt.log" dev=dm-3 ino=31 scontext=unconfined_u:system_r:consoletype_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1333096976.598:78): arch=c000003e syscall=59 success=yes exit=0 a0=985160 a1=985080 a2=98ea50 a3=7fff38014e30 items=0 ppid=2744 pid=2745 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=9 comm="consoletype" exe="/sbin/consoletype" subj=unconfined_u:system_r:consoletype_t:s0 key=(null)
>type=AVC msg=audit(1333096986.944:79): avc:  denied  { write } for  pid=2988 comm="passwd" path=2F746D702F66666939504E4A7944202864656C6574656429 dev=tmpfs ino=18477 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1333096986.944:79): arch=c000003e syscall=59 success=yes exit=0 a0=26361a0 a1=2636760 a2=2635250 a3=7fff671f7280 items=0 ppid=2346 pid=2988 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty1 ses=9 comm="passwd" exe="/usr/bin/passwd" subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 key=(null)
>type=USER_CHAUTHTOK msg=audit(1333096986.959:80): user pid=2988 uid=0 auid=500 ses=9 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=password status displayed for user id=500 exe="/usr/bin/passwd" hostname=? addr=? terminal=tty1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1333097001.943:81): user pid=2996 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=77:2f:37:dd:ee:aa:e0:f3:28:23:11:8a:84:99:35:eb direction=? spid=2996 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1333097001.943:82): user pid=2996 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:97:9c:4f:06:ff:ca:e6:5e:69:58:90:28:72:df:37 direction=? spid=2996 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1333097001.945:83): user pid=2995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=2996 suid=74 rport=43584 laddr=192.168.122.38 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1333097001.945:84): user pid=2995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=2996 suid=74 rport=43584 laddr=192.168.122.38 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=USER_AUTH msg=audit(1333097003.364:85): user pid=2995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="admin" exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=ssh res=failed'
>type=CRYPTO_KEY_USER msg=audit(1333097003.365:86): user pid=2995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=2996 suid=74 rport=43584 laddr=192.168.122.38 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=USER_ERR msg=audit(1333097003.366:87): user pid=2995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident acct="?" exe="/usr/sbin/sshd" hostname=192.168.122.1 addr=192.168.122.1 terminal=ssh res=failed'
>type=CRYPTO_KEY_USER msg=audit(1333097003.366:88): user pid=2995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=77:2f:37:dd:ee:aa:e0:f3:28:23:11:8a:84:99:35:eb direction=? spid=2995 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1333097003.367:89): user pid=2995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:97:9c:4f:06:ff:ca:e6:5e:69:58:90:28:72:df:37 direction=? spid=2995 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=USER_LOGIN msg=audit(1333097003.367:90): user pid=2995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="admin" exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=ssh res=failed'
>type=CRYPTO_KEY_USER msg=audit(1333097013.630:91): user pid=1995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=77:2f:37:dd:ee:aa:e0:f3:28:23:11:8a:84:99:35:eb direction=? spid=1995 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1333097013.630:92): user pid=1995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:97:9c:4f:06:ff:ca:e6:5e:69:58:90:28:72:df:37 direction=? spid=1995 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1333097014.569:93): user pid=3045 uid=0 auid=500 ses=9 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=77:2f:37:dd:ee:aa:e0:f3:28:23:11:8a:84:99:35:eb direction=? spid=3045 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1333097014.569:94): user pid=3045 uid=0 auid=500 ses=9 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:97:9c:4f:06:ff:ca:e6:5e:69:58:90:28:72:df:37 direction=? spid=3045 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1333097014.569:95): user pid=3044 uid=0 auid=500 ses=9 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=3045 suid=74 rport=43591 laddr=192.168.122.38 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1333097014.569:96): user pid=3044 uid=0 auid=500 ses=9 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=3045 suid=74 rport=43591 laddr=192.168.122.38 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=USER_AUTH msg=audit(1333097014.825:97): user pid=3044 uid=0 auid=500 ses=9 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="admin" exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1333097016.568:98): user pid=3044 uid=0 auid=500 ses=9 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="admin" exe="/usr/sbin/sshd" hostname=192.168.122.1 addr=192.168.122.1 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1333097016.571:99): user pid=3044 uid=0 auid=500 ses=9 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="admin" exe="/usr/sbin/sshd" hostname=192.168.122.1 addr=192.168.122.1 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1333097016.572:100): user pid=3044 uid=0 auid=500 ses=9 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3045 suid=74 rport=43591 laddr=192.168.122.38 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=USER_AUTH msg=audit(1333097016.573:101): user pid=3044 uid=0 auid=500 ses=9 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="admin" exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1333097016.574:102): user pid=3044 uid=0 auid=500 ses=9 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="admin" exe="/usr/sbin/sshd" hostname=192.168.122.1 addr=192.168.122.1 terminal=ssh res=success'
>type=LOGIN msg=audit(1333097016.574:103): pid=3044 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=500 new auid=500 old ses=9 new ses=10
>type=USER_ROLE_CHANGE msg=audit(1333097016.651:104): user pid=3044 uid=0 auid=500 ses=10 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=192.168.122.1 addr=192.168.122.1 terminal=ssh res=success'
>type=USER_START msg=audit(1333097016.660:105): user pid=3044 uid=0 auid=500 ses=10 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="admin" exe="/usr/sbin/sshd" hostname=192.168.122.1 addr=192.168.122.1 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1333097016.660:106): user pid=3044 uid=0 auid=500 ses=10 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3044 suid=0 rport=43591 laddr=192.168.122.38 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1333097016.660:107): user pid=3048 uid=0 auid=500 ses=10 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=77:2f:37:dd:ee:aa:e0:f3:28:23:11:8a:84:99:35:eb direction=? spid=3048 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1333097016.661:108): user pid=3048 uid=0 auid=500 ses=10 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:97:9c:4f:06:ff:ca:e6:5e:69:58:90:28:72:df:37 direction=? spid=3048 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.122.1 terminal=? res=success'
>type=CRED_ACQ msg=audit(1333097016.662:109): user pid=3048 uid=0 auid=500 ses=10 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="admin" exe="/usr/sbin/sshd" hostname=192.168.122.1 addr=192.168.122.1 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1333097016.673:110): user pid=3044 uid=0 auid=500 ses=10 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=500 exe="/usr/sbin/sshd" hostname=192.168.122.1 addr=192.168.122.1 terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1333097016.673:111): user pid=3044 uid=0 auid=500 ses=10 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=500 exe="/usr/sbin/sshd" hostname=192.168.122.1 addr=192.168.122.1 terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1333097016.733:112): user pid=3058 uid=0 auid=500 ses=10 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/admin" cmd=646D657367202D6E2031 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1333097016.735:113): user pid=3059 uid=0 auid=500 ses=10 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1333097016.738:114): user pid=3059 uid=0 auid=500 ses=10 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1333097016.752:115): user pid=3066 uid=0 auid=500 ses=10 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/admin" cmd=726D202D7266202F746D702F6F766972742D73657475702E70747330 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1333097016.753:116): user pid=3067 uid=0 auid=500 ses=10 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1333097016.753:117): user pid=3067 uid=0 auid=500 ses=10 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1333097016.759:118): user pid=3068 uid=0 auid=500 ses=10 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/home/admin" cmd="/usr/libexec/ovirt-config-setup" terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1333097016.760:119): user pid=3069 uid=0 auid=500 ses=10 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1333097016.761:120): user pid=3069 uid=0 auid=500 ses=10 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=AVC msg=audit(1333097017.626:121): avc:  denied  { write } for  pid=3098 comm="passwd" path=2F746D702F6666696D7157784B58202864656C6574656429 dev=tmpfs ino=20184 scontext=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file
>type=SYSCALL msg=audit(1333097017.626:121): arch=c000003e syscall=59 success=yes exit=0 a0=178c400 a1=178c9c0 a2=178b4b0 a3=7fff244e30c0 items=0 ppid=3069 pid=3098 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=10 comm="passwd" exe="/usr/bin/passwd" subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 key=(null)
>type=USER_CHAUTHTOK msg=audit(1333097017.644:122): user pid=3098 uid=0 auid=500 ses=10 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=password status displayed for user id=500 exe="/usr/bin/passwd" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1333097043.183:123): user pid=3116 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333097043.184:124): user pid=3116 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333097043.193:125): pid=3116 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=11
>type=USER_START msg=audit(1333097043.200:126): user pid=3116 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333097043.490:127): user pid=3116 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333097043.490:128): user pid=3116 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333097161.501:129): user pid=3142 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333097161.501:130): user pid=3142 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333097161.503:131): pid=3142 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=12
>type=USER_START msg=audit(1333097161.514:132): user pid=3142 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333097161.763:133): user pid=3142 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333097161.763:134): user pid=3142 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333097281.769:135): user pid=3166 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333097281.769:136): user pid=3166 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333097281.770:137): pid=3166 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=13
>type=USER_START msg=audit(1333097281.779:138): user pid=3166 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333097281.913:139): user pid=3166 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333097281.913:140): user pid=3166 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333097401.919:141): user pid=3195 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333097401.919:142): user pid=3195 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333097401.919:143): user pid=3197 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1333097401.919:144): user pid=3194 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333097401.919:145): user pid=3197 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333097401.919:146): user pid=3194 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333097401.919:147): pid=3195 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=14
>type=LOGIN msg=audit(1333097401.920:148): pid=3197 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=15
>type=LOGIN msg=audit(1333097401.920:149): pid=3194 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=16
>type=USER_ACCT msg=audit(1333097401.921:150): user pid=3196 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1333097401.921:151): user pid=3196 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1333097401.921:152): pid=3196 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=17
>type=USER_START msg=audit(1333097401.924:153): user pid=3194 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333097401.924:154): user pid=3195 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333097401.924:155): user pid=3197 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1333097401.926:156): user pid=3196 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333097401.937:157): user pid=3196 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333097401.937:158): user pid=3197 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333097401.937:159): user pid=3196 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333097401.937:160): user pid=3197 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333097402.038:161): user pid=3195 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333097402.038:162): user pid=3195 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1333097402.082:163): user pid=3194 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1333097402.082:164): user pid=3194 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'

Actions: View

Attachments on bug 808368: 573920