Attachment 696649 Details for Bug 910568 – strace of audit when run by hand

strace of audit when run by hand

audit-hand.strace (text/plain), 88.93 KB, created by Eric Paris on 2013-02-12 23:08:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eric Paris

Created: 2013-02-12 23:08:32 UTC

Size: 88.93 KB

patch

obsolete

>execve("/sbin/auditd", ["/sbin/auditd", "-n"], [/* 29 vars */]) = 0
>brk(0)                                  = 0x7f1f2467f000
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a1e000
>access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
>open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
>fstat(3, {st_mode=S_IFREG|0644, st_size=83191, ...}) = 0
>mmap(NULL, 83191, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f1f22a09000
>close(3)                                = 0
>open("/lib64/libwrap.so.0", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`1@x5\0\0\0@\0\0\0\0\0\0\0p\246\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\37\0\36\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0@x5\0\0\0\0\0@x5\0\0\0d\200\0\0\0\0\0\0d\200\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P\215\0\0\0\0\0\0P\215`x5\0\0\0P\215`x5\0\0\0\\\n\0\0\0\0\0\0p\23\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0p\215\0\0\0\0\0\0p\215`x5\0\0\0p\215`x5\0\0\0\340\1\0\0\0\0\0\0\340\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1@x5\0\0\0\310\1@x5\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0,t\0\0\0\0\0\0,t@x5\0\0\0,t@x5\0\0\0\354\1\0\0\0\0\0\0\354\1\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0R\345td\4\0\0\0P\215\0\0\0\0\0\0P\215`x5\0\0\0P\215`x5\0\0\0\260\2\0\0\0\0\0\0\260\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0P\326)\301]iB-f\346\232\221\371\t^\336\244n\204\307\0\0\0\0%\0\0\0_\0\0\0\4\0\0\0\10\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=44592, ...}) = 0
>mmap(NULL, 2138304, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f225f4000
>mprotect(0x7f1f225fd000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f227fc000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8000) = 0x7f1f227fc000
>mmap(0x7f1f227fe000, 192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1f227fe000
>close(3)                                = 0
>open("/lib64/libnsl.so.1", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20A\340p5\0\0\0@\0\0\0\0\0\0\0\0\275\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\340p5\0\0\0@\0\340p5\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\0.\1\0\0\0\0\0\0.\341p5\0\0\0\0.\341p5\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\340p5\0\0\0\0\0\340p5\0\0\0\304[\1\0\0\0\0\0\304[\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0P]\1\0\0\0\0\0P]\1q5\0\0\0P]\1q5\0\0\0\10\6\0\0\0\0\0\0\210-\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0p]\1\0\0\0\0\0p]\1q5\0\0\0p]\1q5\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2\340p5\0\0\0008\2\340p5\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\34.\1\0\0\0\0\0\34.\341p5\0\0\0\34.\341p5\0\0\0L\5\0\0\0\0\0\0L\5\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=116224, ...}) = 0
>mmap(NULL, 2198232, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f223db000
>mprotect(0x7f1f223f1000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f225f0000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15000) = 0x7f1f225f0000
>mmap(0x7f1f225f2000, 6872, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1f225f2000
>close(3)                                = 0
>open("/lib64/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360j\340V5\0\0\0@\0\0\0\0\0\0\0h*\2\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0)\0(\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\340V5\0\0\0@\0\340V5\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\260\v\1\0\0\0\0\0\260\v\341V5\0\0\0\260\v\341V5\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\340V5\0\0\0\0\0\340V5\0\0\0\330[\1\0\0\0\0\0\330[\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0xk\1\0\0\0\0\0xk\1W5\0\0\0xk\1W5\0\0\0,\7\0\0\0\0\0\0\260H\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0pm\1\0\0\0\0\0pm\1W5\0\0\0pm\1W5\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2\340V5\0\0\0008\2\340V5\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\314\v\1\0\0\0\0\0\314\v\341V5\0\0\0\314\v\341V5\0\0\0\f\n\0\0\0\0\0\0\f\n\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=144552, ...}) = 0
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a08000
>mmap(NULL, 2208808, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f221bf000
>mprotect(0x7f1f221d5000, 2097152, PROT_NONE) = 0
>mmap(0x7f1f223d5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16000) = 0x7f1f223d5000
>mmap(0x7f1f223d7000, 13352, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1f223d7000
>close(3)                                = 0
>open("/lib64/librt.so.1", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\" W5\0\0\0@\0\0\0\0\0\0\0\210\257\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0*\0)\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0 W5\0\0\0@\0 W5\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0 W\0\0\0\0\0\0 W W5\0\0\0 W W5\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0 W5\0\0\0\0\0 W5\0\0\0hh\0\0\0\0\0\0hh\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0Hm\0\0\0\0\0\0Hm@W5\0\0\0Hm@W5\0\0\0,\5\0\0\0\0\0\0\20\17\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0xm\0\0\0\0\0\0xm@W5\0\0\0xm@W5\0\0\0@\2\0\0\0\0\0\0@\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2 W5\0\0\0008\2 W5\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0<W\0\0\0\0\0\0<W W5\0\0\0<W W5\0\0\0D\2\0\0\0\0\0\0D\2\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=47624, ...}) = 0
>mmap(NULL, 2128984, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f21fb7000
>mprotect(0x7f1f21fbe000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f221bd000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7f1f221bd000
>close(3)                                = 0
>open("/lib64/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260U\240W5\0\0\0@\0\0\0\0\0\0\0@[\21\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0'\0&\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\240W5\0\0\0@\0\240W5\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\0y\17\0\0\0\0\0\0y\257W5\0\0\0\0y\257W5\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\240W5\0\0\0\0\0\240W5\0\0\0\310\360\17\0\0\0\0\0\310\360\17\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\250\374\17\0\0\0\0\0\250\374\317W5\0\0\0\250\374\317W5\0\0\0004\4\0\0\0\0\0\0\200\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\310\374\17\0\0\0\0\0\310\374\317W5\0\0\0\310\374\317W5\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2\240W5\0\0\0008\2\240W5\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\34y\17\0\0\0\0\0\34y\257W5\0\0\0\34y\257W5\0\0\0\4\22\0\0\0\0\0\0\4\22\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=1139968, ...}) = 0
>mmap(NULL, 3146024, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f21cb6000
>mprotect(0x7f1f21db6000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f21fb5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xff000) = 0x7f1f21fb5000
>close(3)                                = 0
>open("/lib64/libgssapi_krb5.so.2", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\255\200\242<\0\0\0@\0\0\0\0\0\0\0\370B\4\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0 \0\37\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\200\242<\0\0\0\0\0\200\242<\0\0\0\214\0\4\0\0\0\0\0\214\0\4\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0h\1\4\0\0\0\0\0h\1\244\242<\0\0\0h\1\244\242<\0\0\0`#\0\0\0\0\0\0\230&\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10\n\4\0\0\0\0\0\10\n\244\242<\0\0\0\10\n\244\242<\0\0\0`\2\0\0\0\0\0\0`\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\200\242<\0\0\0\310\1\200\242<\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\230\260\3\0\0\0\0\0\230\260\203\242<\0\0\0\230\260\203\242<\0\0\0\304\f\0\0\0\0\0\0\304\f\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0R\345td\4\0\0\0h\1\4\0\0\0\0\0h\1\244\242<\0\0\0h\1\244\242<\0\0\0\230\16\0\0\0\0\0\0\230\16\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\212\235\303\366\235\311\21\373z\275\321D'\334\375\367\16\262z\236\0\0\0\0\203\0\0\0\357\0\0\0\20\0\0\0\n\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=281336, ...}) = 0
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a07000
>mmap(NULL, 2369536, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f21a73000
>mprotect(0x7f1f21ab4000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f21cb3000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x40000) = 0x7f1f21cb3000
>close(3)                                = 0
>open("/lib64/libkrb5.so.3", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\266\1\242<\0\0\0@\0\0\0\0\0\0\0H\177\16\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0!\0 \0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\242<\0\0\0\0\0\0\242<\0\0\0\22\214\r\0\0\0\0\0\22\214\r\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0 \232\r\0\0\0\0\0 \232-\242<\0\0\0 \232-\242<\0\0\0h\255\0\0\0\0\0\0\300\260\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0 *\16\0\0\0\0\0 *.\242<\0\0\0 *.\242<\0\0\0P\2\0\0\0\0\0\0P\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\0\242<\0\0\0\310\1\0\242<\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\20O\f\0\0\0\0\0\20O\f\242<\0\0\0\20O\f\242<\0\0\0D1\0\0\0\0\0\0D1\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0R\345td\4\0\0\0 \232\r\0\0\0\0\0 \232-\242<\0\0\0 \232-\242<\0\0\0\340\225\0\0\0\0\0\0\340\225\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\226\0\334\242r\22M}^q\201\207Y`>\217\21\372 x\0\0\0\0\t\2\0\0\355\0\0\0@\0\0\0\f\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=952200, ...}) = 0
>mmap(NULL, 3033824, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f2178e000
>mprotect(0x7f1f21867000, 2097152, PROT_NONE) = 0
>mmap(0x7f1f21a67000, 49152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xd9000) = 0x7f1f21a67000
>close(3)                                = 0
>open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\33bV5\0\0\0@\0\0\0\0\0\0\0\220\220\37\0\0\0\0\0\0\0\0\0@\0008\0\n\0@\0+\0*\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0`V5\0\0\0@\0`V5\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\0\314\27\0\0\0\0\0\0\314wV5\0\0\0\0\314wV5\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0`V5\0\0\0\0\0`V5\0\0\0\364\315\32\0\0\0\0\0\364\315\32\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\360\326\32\0\0\0\0\0\360\326\232V5\0\0\0\360\326\232V5\0\0\0\220Q\0\0\0\0\0\0\10\235\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0@\v\33\0\0\0\0\0@\v\233V5\0\0\0@\v\233V5\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0p\2\0\0\0\0\0\0p\2`V5\0\0\0p\2`V5\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\7\0\0\0\4\0\0\0\360\326\32\0\0\0\0\0\360\326\232V5\0\0\0\360\326\232V5\0\0\0\20\0\0\0\0\0\0\0\220\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0P\345td\4\0\0\0\34\314\27\0\0\0\0\0\34\314wV5\0\0\0\34\314wV5\0\0\0<h\0\0\0\0\0\0<h\0\0\0\0\0\0\4\0\0\0\0\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=2071376, ...}) = 0
>mmap(NULL, 3896312, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f213d6000
>mprotect(0x7f1f21583000, 2097152, PROT_NONE) = 0
>mmap(0x7f1f21783000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ad000) = 0x7f1f21783000
>mmap(0x7f1f21789000, 17400, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1f21789000
>close(3)                                = 0
>open("/lib64/libk5crypto.so.3", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320D\300\241<\0\0\0@\0\0\0\0\0\0\0@\247\2\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0 \0\37\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\300\241<\0\0\0\0\0\300\241<\0\0\0tz\2\0\0\0\0\0tz\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\20\201\2\0\0\0\0\0\20\201\342\241<\0\0\0\20\201\342\241<\0\0\0\350\21\0\0\0\0\0\0\240 \0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\10\215\2\0\0\0\0\0\10\215\342\241<\0\0\0\10\215\342\241<\0\0\0 \2\0\0\0\0\0\0 \2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\300\241<\0\0\0\310\1\300\241<\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\374J\2\0\0\0\0\0\374J\302\241<\0\0\0\374J\302\241<\0\0\0\264\6\0\0\0\0\0\0\264\6\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0R\345td\4\0\0\0\20\201\2\0\0\0\0\0\20\201\342\241<\0\0\0\20\201\342\241<\0\0\0\360\16\0\0\0\0\0\0\360\16\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\305\324\362\32\232\0p\320r2\24\r\360\367&@_\263\3A\0\0\0\0a\0\0\0/\0\0\0\20\0\0\0\n\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=175936, ...}) = 0
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a06000
>mmap(NULL, 2269616, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f211ab000
>mprotect(0x7f1f211d3000, 2097152, PROT_NONE) = 0
>mmap(0x7f1f213d3000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x28000) = 0x7f1f213d3000
>mmap(0x7f1f213d5000, 432, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1f213d5000
>close(3)                                = 0
>open("/lib64/libcom_err.so.2", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0`\25\340j5\0\0\0@\0\0\0\0\0\0\0x?\0\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0 \0\37\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\340j5\0\0\0\0\0\340j5\0\0\0\24&\0\0\0\0\0\0\24&\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0l-\0\0\0\0\0\0l-\0k5\0\0\0l-\0k5\0\0\0\334\3\0\0\0\0\0\0|\4\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240-\0\0\0\0\0\0\240-\0k5\0\0\0\240-\0k5\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2\340j5\0\0\0\0\2\340j5\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\7\0\0\0\4\0\0\0l-\0\0\0\0\0\0l-\0k5\0\0\0l-\0k5\0\0\0\0\0\0\0\0\0\0\0\31\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0P\345td\4\0\0\0D\"\0\0\0\0\0\0D\"\340j5\0\0\0D\"\340j5\0\0\0\274\0\0\0\0\0\0\0\274\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0R\345td\4\0\0\0l-\0\0\0\0\0\0l-\0k5\0\0\0l-\0k5\0\0\0\224\2\0\0\0\0\0\0\224\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=18296, ...}) = 0
>mmap(NULL, 2109928, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f20fa7000
>mprotect(0x7f1f20faa000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f211a9000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f1f211a9000
>close(3)                                = 0
>open("/lib64/libkrb5support.so.0", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P+@\242<\0\0\0@\0\0\0\0\0\0\0\240\263\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0 \0\37\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0@\242<\0\0\0\0\0@\242<\0\0\0D\232\0\0\0\0\0\0D\232\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\300\234\0\0\0\0\0\0\300\234`\242<\0\0\0\300\234`\242<\0\0\0\20\6\0\0\0\0\0\0\320\7\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\20\235\0\0\0\0\0\0\20\235`\242<\0\0\0\20\235`\242<\0\0\0000\2\0\0\0\0\0\0000\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1@\242<\0\0\0\310\1@\242<\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\\\206\0\0\0\0\0\0\\\206@\242<\0\0\0\\\206@\242<\0\0\0T\3\0\0\0\0\0\0T\3\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0R\345td\4\0\0\0\300\234\0\0\0\0\0\0\300\234`\242<\0\0\0\300\234`\242<\0\0\0@\3\0\0\0\0\0\0@\3\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\324\244\\\302(\341*\1\302:2b\3\276\242\216z\v\242\207\0\0\0\0%\0\0\0L\0\0\0\10\0\0\0\t\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=48032, ...}) = 0
>mmap(NULL, 2139280, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f20d9c000
>mprotect(0x7f1f20da6000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f20fa5000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x9000) = 0x7f1f20fa5000
>close(3)                                = 0
>open("/lib64/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\16\240V5\0\0\0@\0\0\0\0\0\0\0\250N\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0$\0#\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\240V5\0\0\0@\0\240V5\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\240\32\0\0\0\0\0\0\240\32\240V5\0\0\0\240\32\240V5\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\240V5\0\0\0\0\0\240V5\0\0\0h \0\0\0\0\0\0h \0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0X-\0\0\0\0\0\0X-\300V5\0\0\0X-\300V5\0\0\0@\3\0\0\0\0\0\0\320\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\210-\0\0\0\0\0\0\210-\300V5\0\0\0\210-\300V5\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2\240V5\0\0\0008\2\240V5\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\274\32\0\0\0\0\0\0\274\32\240V5\0\0\0\274\32\240V5\0\0\0\274\0\0\0\0\0\0\0\274\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=22440, ...}) = 0
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a05000
>mmap(NULL, 2109736, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f20b98000
>mprotect(0x7f1f20b9b000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f20d9a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f1f20d9a000
>close(3)                                = 0
>open("/lib64/libkeyutils.so.1", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\21`m5\0\0\0@\0\0\0\0\0\0\0\30>\0\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\37\0\36\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0`m5\0\0\0\0\0`m5\0\0\0\224 \0\0\0\0\0\0\224 \0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\240-\0\0\0\0\0\0\240-\200m5\0\0\0\240-\200m5\0\0\0\0\3\0\0\0\0\0\0\10\3\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\300-\0\0\0\0\0\0\300-\200m5\0\0\0\300-\200m5\0\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1`m5\0\0\0\310\1`m5\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\200\33\0\0\0\0\0\0\200\33`m5\0\0\0\200\33`m5\0\0\0\4\1\0\0\0\0\0\0\4\1\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0R\345td\4\0\0\0\240-\0\0\0\0\0\0\240-\200m5\0\0\0\240-\200m5\0\0\0`\2\0\0\0\0\0\0`\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0Hk\366\375\206\201\266\250\376\327\20\7j\214T\20\372.\217S\0\0\0\0%\0\0\0\17\0\0\0\4\0\0\0\10\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=17880, ...}) = 0
>mmap(NULL, 2109608, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f20994000
>mprotect(0x7f1f20997000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f20b96000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f1f20b96000
>close(3)                                = 0
>open("/lib64/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000:`X5\0\0\0@\0\0\0\0\0\0\0H\243\1\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0%\0$\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0`X5\0\0\0@\0`X5\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0\0201\1\0\0\0\0\0\0201aX5\0\0\0\0201aX5\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0`X5\0\0\0\0\0`X5\0\0\0\200R\1\0\0\0\0\0\200R\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\220T\1\0\0\0\0\0\220T\201X5\0\0\0\220T\201X5\0\0\0\360\r\0\0\0\0\0\0\0106\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\220]\1\0\0\0\0\0\220]\201X5\0\0\0\220]\201X5\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2`X5\0\0\0008\2`X5\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0,1\1\0\0\0\0\0,1aX5\0\0\0,1aX5\0\0\0\204\3\0\0\0\0\0\0\204\3\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=109704, ...}) = 0
>mmap(NULL, 2198168, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f2077b000
>mprotect(0x7f1f20791000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f20990000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15000) = 0x7f1f20990000
>mmap(0x7f1f20992000, 6808, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1f20992000
>close(3)                                = 0
>open("/lib64/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0@*\240X5\0\0\0@\0\0\0\0\0\0\0\230\\\1\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0!\0 \0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\240X5\0\0\0\0\0\240X5\0\0\0tG\1\0\0\0\0\0tG\1\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270M\1\0\0\0\0\0\270M\301X5\0\0\0\270M\301X5\0\0\0\310\3\0\0\0\0\0\0`\6\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\330M\1\0\0\0\0\0\330M\301X5\0\0\0\330M\301X5\0\0\0\360\1\0\0\0\0\0\0\360\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\240X5\0\0\0\310\1\240X5\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\270*\1\0\0\0\0\0\270*\241X5\0\0\0\270*\241X5\0\0\0004\5\0\0\0\0\0\0004\5\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0R\345td\4\0\0\0\270M\1\0\0\0\0\0\270M\301X5\0\0\0\270M\301X5\0\0\0H\2\0\0\0\0\0\0H\2\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0!\310J\3174\365\2\345\34?/\206ya\206\227`)\360)\0\0\0\0\203\0\0\0\27\0\0\0\20\0\0\0\n\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=91352, ...}) = 0
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a04000
>mmap(NULL, 2184216, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f20565000
>mprotect(0x7f1f2057a000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f20779000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x14000) = 0x7f1f20779000
>close(3)                                = 0
>open("/lib64/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0Pa@\236<\0\0\0@\0\0\0\0\0\0\0\3100\2\0\0\0\0\0\0\0\0\0@\0008\0\10\0@\0!\0\36\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0@\236<\0\0\0\0\0@\236<\0\0\0D\r\2\0\0\0\0\0D\r\2\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\270\34\2\0\0\0\0\0\270\34b\236<\0\0\0\270\34b\236<\0\0\0\274\10\0\0\0\0\0\0\220\33\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0H\35\2\0\0\0\0\0H\35b\236<\0\0\0H\35b\236<\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\2\0\0\0\0\0\0\0\2@\236<\0\0\0\0\2@\236<\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\7\0\0\0\4\0\0\0\270\34\2\0\0\0\0\0\270\34b\236<\0\0\0\270\34b\236<\0\0\0\0\0\0\0\0\0\0\0\331\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0P\345td\4\0\0\0\360\322\1\0\0\0\0\0\360\322A\236<\0\0\0\360\322A\236<\0\0\0\344\t\0\0\0\0\0\0\344\t\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0R\345td\4\0\0\0\270\34\2\0\0\0\0\0\270\34b\236<\0\0\0\270\34b\236<\0\0\0H\3\0\0\0\0\0\0H\3\0\0\0\0\0\0\1\0\0\0\0\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=178734, ...}) = 0
>mmap(NULL, 2242632, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f20341000
>mprotect(0x7f1f20362000, 2097152, PROT_NONE) = 0
>mmap(0x7f1f20562000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x21000) = 0x7f1f20562000
>mmap(0x7f1f20564000, 2120, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f1f20564000
>close(3)                                = 0
>open("/lib64/libpcre.so.1", O_RDONLY|O_CLOEXEC) = 3
>read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\35\340W5\0\0\0@\0\0\0\0\0\0\0x\344\5\0\0\0\0\0\0\0\0\0@\0008\0\7\0@\0\37\0\36\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\340W5\0\0\0\0\0\340W5\0\0\0\244\276\5\0\0\0\0\0\244\276\5\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0000\314\5\0\0\0\0\0000\314\5X5\0\0\0000\314\5X5\0\0\0@\5\0\0\0\0\0\0\30\6\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0x\315\5\0\0\0\0\0x\315\5X5\0\0\0x\315\5X5\0\0\0\320\1\0\0\0\0\0\0\320\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\310\1\0\0\0\0\0\0\310\1\340W5\0\0\0\310\1\340W5\0\0\0$\0\0\0\0\0\0\0$\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\300\232\5\0\0\0\0\0\300\232\345W5\0\0\0\300\232\345W5\0\0\0\204\4\0\0\0\0\0\0\204\4\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0R\345td\4\0\0\0000\314\5\0\0\0\0\0000\314\5X5\0\0\0000\314\5X5\0\0\0\320\3\0\0\0\0\0\0\320\3\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\24\0\0\0\3\0\0\0GNU\0\340T\336B\2\361\244r\365\243\347&\267\3641\353dQ\243\257\0\0\0\0%\0\0\0\34\0\0\0\10\0\0\0\t\0\0\0"..., 832) = 832
>fstat(3, {st_mode=S_IFREG|0755, st_size=388152, ...}) = 0
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a03000
>mmap(NULL, 2478664, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f1f200e3000
>mprotect(0x7f1f2013f000, 2097152, PROT_NONE) = 0
>mmap(0x7f1f2033f000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5c000) = 0x7f1f2033f000
>close(3)                                = 0
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a02000
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a01000
>mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f229ff000
>arch_prctl(ARCH_SET_FS, 0x7f1f229ff840) = 0
>mprotect(0x7f1f21783000, 16384, PROT_READ) = 0
>mprotect(0x7f1f2033f000, 4096, PROT_READ) = 0
>mprotect(0x7f1f223d5000, 4096, PROT_READ) = 0
>mprotect(0x7f1f20d9a000, 4096, PROT_READ) = 0
>mprotect(0x7f1f20562000, 4096, PROT_READ) = 0
>mprotect(0x7f1f20779000, 4096, PROT_READ) = 0
>mprotect(0x7f1f20990000, 4096, PROT_READ) = 0
>mprotect(0x7f1f20b96000, 4096, PROT_READ) = 0
>mprotect(0x7f1f20fa5000, 4096, PROT_READ) = 0
>mprotect(0x7f1f211a9000, 4096, PROT_READ) = 0
>mprotect(0x7f1f213d3000, 4096, PROT_READ) = 0
>mprotect(0x7f1f21a67000, 40960, PROT_READ) = 0
>mprotect(0x7f1f21cb3000, 4096, PROT_READ) = 0
>mprotect(0x7f1f21fb5000, 4096, PROT_READ) = 0
>mprotect(0x7f1f221bd000, 4096, PROT_READ) = 0
>mprotect(0x7f1f225f0000, 4096, PROT_READ) = 0
>mprotect(0x7f1f227fc000, 4096, PROT_READ) = 0
>mprotect(0x7f1f22c41000, 4096, PROT_READ) = 0
>mprotect(0x7f1f22a1f000, 4096, PROT_READ) = 0
>munmap(0x7f1f22a09000, 83191)           = 0
>set_tid_address(0x7f1f229ffb10)         = 3254
>set_robust_list(0x7f1f229ffb20, 24)     = 0
>rt_sigaction(SIGRTMIN, {0x7f1f221c5650, [], SA_RESTORER|SA_SIGINFO, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_1, {0x7f1f221c56d0, [], SA_RESTORER|SA_RESTART|SA_SIGINFO, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
>getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
>statfs("/sys/fs/selinux", {f_type=0xf97cff8c, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
>statfs("/sys/fs/selinux", {f_type=0xf97cff8c, f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
>stat("/sys/fs/selinux", {st_mode=S_IFDIR|0755, st_size=0, ...}) = 0
>brk(0)                                  = 0x7f1f2467f000
>brk(0x7f1f246a0000)                     = 0x7f1f246a0000
>umask(077)                              = 022
>umask(022)                              = 077
>getuid()                                = 0
>rt_sigaction(SIGHUP, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGINT, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGQUIT, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGILL, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGTRAP, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGABRT, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGBUS, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGFPE, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGKILL, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = -1 EINVAL (Invalid argument)
>rt_sigaction(SIGUSR1, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGSEGV, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGUSR2, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGPIPE, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGALRM, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGTERM, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGSTKFLT, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGCHLD, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGCONT, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGSTOP, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = -1 EINVAL (Invalid argument)
>rt_sigaction(SIGTSTP, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGTTIN, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGTTOU, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGURG, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGXCPU, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGXFSZ, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGVTALRM, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGPROF, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGWINCH, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGIO, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGPWR, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGSYS, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_2, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_3, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_4, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_5, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_6, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_7, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_8, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_9, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_10, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_11, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_12, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_13, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_14, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_15, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_16, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_17, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_18, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_19, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_20, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_21, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_22, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_23, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_24, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_25, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_26, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_27, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_28, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_29, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_30, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_31, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGRT_32, {SIG_IGN, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>setrlimit(RLIMIT_FSIZE, {rlim_cur=RLIM64_INFINITY, rlim_max=RLIM64_INFINITY}) = 0
>setrlimit(RLIMIT_CPU, {rlim_cur=RLIM64_INFINITY, rlim_max=RLIM64_INFINITY}) = 0
>open("/etc/audit/auditd.conf", O_RDONLY|O_NOFOLLOW) = 3
>fstat(3, {st_mode=S_IFREG|0640, st_size=701, ...}) = 0
>fcntl(3, F_GETFL)                       = 0x28000 (flags O_RDONLY|O_LARGEFILE|O_NOFOLLOW)
>lseek(3, 0, SEEK_CUR)                   = 0
>fstat(3, {st_mode=S_IFREG|0640, st_size=701, ...}) = 0
>mmap(NULL, 701, PROT_READ, MAP_SHARED, 3, 0) = 0x7f1f22a1d000
>lseek(3, 701, SEEK_SET)                 = 701
>openat(AT_FDCWD, "/var/log/audit", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 4
>close(4)                                = 0
>open("/var/log/audit/audit.log", O_RDONLY|O_APPEND) = 4
>fstat(4, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
>close(4)                                = 0
>socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
>connect(4, {sa_family=AF_FILE, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
>close(4)                                = 0
>socket(PF_FILE, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
>connect(4, {sa_family=AF_FILE, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
>close(4)                                = 0
>open("/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 4
>fstat(4, {st_mode=S_IFREG|0644, st_size=1722, ...}) = 0
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a1c000
>read(4, "#\n# /etc/nsswitch.conf\n#\n# An example Name Service Switch config file. This file should be\n# sorted with the most-used services at the beginning.\n#\n# The entry '[NOTFOUND=return]' means that the search for an\n# entry should stop if the search in the previous entry turned\n# up nothing. Note that if the search failed due to some other reason\n# (like no NIS server responding) then the search continues with the\n# next entry.\n#\n# Valid entries include:\n#\n#\tnisplus\t\t\tUse NIS+ (NIS version 3)\n#\tnis\t\t\tUse NIS (NIS "..., 4096) = 1722
>read(4, "", 4096)                       = 0
>close(4)                                = 0
>munmap(0x7f1f22a1c000, 4096)            = 0
>open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 4
>fstat(4, {st_mode=S_IFREG|0644, st_size=83191, ...}) = 0
>mmap(NULL, 83191, PROT_READ, MAP_PRIVATE, 4, 0) = 0x7f1f229ea000
>close(4)                                = 0
>open("/lib64/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = 4
>read(4, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340!\0\0\0\0\0\0@\0\0\0\0\0\0\0P\353\0\0\0\0\0\0\0\0\0\0@\0008\0\t\0@\0\"\0!\0\6\0\0\0\5\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\370\1\0\0\0\0\0\0\370\1\0\0\0\0\0\0\10\0\0\0\0\0\0\0\3\0\0\0\4\0\0\0@\227\0\0\0\0\0\0@\227\0\0\0\0\0\0@\227\0\0\0\0\0\0\34\0\0\0\0\0\0\0\34\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\261\0\0\0\0\0\0h\261\0\0\0\0\0\0\0\0 \0\0\0\0\0\1\0\0\0\6\0\0\0\200\275\0\0\0\0\0\0\200\275 \0\0\0\0\0\200\275 \0\0\0\0\0x\5\0\0\0\0\0\0\350\n\0\0\0\0\0\0\0\0 \0\0\0\0\0\2\0\0\0\6\0\0\0\240\275\0\0\0\0\0\0\240\275 \0\0\0\0\0\240\275 \0\0\0\0\0\20\2\0\0\0\0\0\0\20\2\0\0\0\0\0\0\10\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0008\2\0\0\0\0\0\0D\0\0\0\0\0\0\0D\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0P\345td\4\0\0\0\\\227\0\0\0\0\0\0\\\227\0\0\0\0\0\0\\\227\0\0\0\0\0\0\224\2\0\0\0\0\0\0\224\2\0\0\0\0\0\0\4\0\0\0\0\0\0\0Q\345td\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0"..., 832) = 832
>fstat(4, {st_mode=S_IFREG|0755, st_size=62416, ...}) = 0
>mmap(NULL, 2148456, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 4, 0) = 0x7f1f1fed6000
>mprotect(0x7f1f1fee2000, 2093056, PROT_NONE) = 0
>mmap(0x7f1f200e1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 4, 0xb000) = 0x7f1f200e1000
>close(4)                                = 0
>mprotect(0x7f1f200e1000, 4096, PROT_READ) = 0
>munmap(0x7f1f229ea000, 83191)           = 0
>open("/etc/group", O_RDONLY|O_CLOEXEC)  = 4
>fstat(4, {st_mode=S_IFREG|0644, st_size=836, ...}) = 0
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f229fe000
>read(4, "root:x:0:\nbin:x:1:\ndaemon:x:2:\nsys:x:3:\nadm:x:4:\ntty:x:5:\ndisk:x:6:\nlp:x:7:\nmem:x:8:\nkmem:x:9:\nwheel:x:10:eparis\nmail:x:12:\nuucp:x:14:\nman:x:15:\ngames:x:20:\ngopher:x:30:\nvideo:x:39:\ndip:x:40:\nftp:x:50:\nlock:x:54:\naudio:x:63:\nnobody:x:99:\nusers:x:100:\noprofile:x:16:\nutmp:x:22:\nutempter:x:35:\navahi-autoipd:x:170:\ncdrom:x:11:\ntape:x:33:\ndialout:x:18:\nfloppy:x:19:\ndbus:x:81:\npolkitd:x:999:\nabrt:x:173:\nusbmuxd:x:113:\nrpc:x:32:\nssh_keys:x:998:\nrtkit:x:172:\nopenvpn:x:997:\ncolord:x:996:\nradvd:x:995:\ntss:x:59:\nsasla"..., 4096) = 836
>close(4)                                = 0
>munmap(0x7f1f229fe000, 4096)            = 0
>open("/sbin/audispd", O_RDONLY)         = 4
>fstat(4, {st_mode=S_IFREG|0750, st_size=44992, ...}) = 0
>close(4)                                = 0
>fstat(3, {st_mode=S_IFREG|0640, st_size=701, ...}) = 0
>lseek(3, 701, SEEK_SET)                 = 701
>munmap(0x7f1f22a1d000, 701)             = 0
>close(3)                                = 0
>getpriority(PRIO_PROCESS, 0)            = 20
>setpriority(PRIO_PROCESS, 0, 4294967292) = 0
>getpriority(PRIO_PROCESS, 0)            = 24
>open("/dev/null", O_RDWR)               = 3
>dup2(3, 0)                              = 0
>dup2(3, 1)                              = 1
>dup2(3, 2)                              = 2
>close(3)                                = 0
>chdir("/")                              = 0
>setsid()                                = 3254
>socket(PF_NETLINK, SOCK_RAW, 9)         = 3
>fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
>open("/var/run/auditd.pid", O_WRONLY|O_CREAT|O_TRUNC|O_NOFOLLOW, 0644) = 4
>write(4, "3254\n", 5)                   = 5
>close(4)                                = 0
>open("/var/log/audit/audit.log", O_WRONLY|O_APPEND|O_NOFOLLOW) = 4
>fstat(4, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
>fcntl(4, F_SETFD, FD_CLOEXEC)           = 0
>fchmod(4, 0600)                         = 0
>fchown(4, 0, 0)                         = 0
>fcntl(4, F_GETFL)                       = 0x28401 (flags O_WRONLY|O_APPEND|O_LARGEFILE|O_NOFOLLOW)
>fstat(4, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a1d000
>lseek(4, 0, SEEK_CUR)                   = 0
>mmap(NULL, 8392704, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f1f1f6d5000
>mprotect(0x7f1f1f6d5000, 4096, PROT_NONE) = 0
>clone(child_stack=0x7f1f1fed4eb0, flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, parent_tidptr=0x7f1f1fed59d0, tls=0x7f1f1fed5700, child_tidptr=0x7f1f1fed59d0) = 3255
>unlink("/var/log/audit/audit.log.5")    = -1 ENOENT (No such file or directory)
>fstatfs(4, {f_type=0x9123683e, f_bsize=4096, f_blocks=9325312, f_bfree=8020402, f_bavail=7670274, f_files=0, f_ffree=0, f_fsid={-1350692723, -83987812}, f_namelen=255, f_frsize=4096}) = 0
>socketpair(PF_FILE, SOCK_STREAM, 0, [5, 6]) = 0
>fcntl(5, F_GETFL)                       = 0x2 (flags O_RDWR)
>fcntl(5, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
>fcntl(6, F_GETFL)                       = 0x2 (flags O_RDWR)
>fcntl(6, F_SETFL, O_RDWR|O_NONBLOCK)    = 0
>clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f1f229ffb10) = 3256
>close(5)                                = 0
>fcntl(6, F_SETFD, FD_CLOEXEC)           = 0
>open("/etc/localtime", O_RDONLY|O_CLOEXEC) = 5
>fstat(5, {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0
>fstat(5, {st_mode=S_IFREG|0644, st_size=3519, ...}) = 0
>mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1f22a1c000
>read(5, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\353\0\0\0\4\0\0\0\20\236\246\36p\237\272\353`\240\206\0p\241\232\315`\242e\342p\243\203\351\340\244j\256p\2455\247`\246S\312\360\247\25\211`\2503\254\360\250\376\245\340\252\23\216\360\252\336\207\340\253\363p\360\254\276i\340\255\323R\360\256\236K\340\257\2634\360\260~-\340\261\234Qp\262gJ`\263|3p\264G,`\265\\\25p\266'\16`\267;\367p\270\6\360`\271\33\331p\271\346\322`\273\4\365\360\273\306\264`\274\344\327\360\275\257\320\340\276\304\271\360\277\217\262\340\300\244\233\360\301o\224\340\302\204}\360\303Ov\340\304d_\360\305/X\340\306M|p\307\17:\340\310-^p\310\370W`\312\r@p\312\3309`\313\210\360p\322#\364p\322`\373\340\323u\344\360\324@\335\340\325U\306\360\326 \277\340\3275\250\360\330\0\241\340\331\25\212\360\331\340\203\340\332\376\247p\333\300e\340\334\336\211p\335\251\202`\336\276kp\337\211d`\340\236Mp\341iF`\342~/p\343I(`\344^\21p\345W.\340\346G-\360\3477\20\340\350'\17\360\351\26\362\340\352\6\361\360\352\366\324\340\353\346\323\360\354\326\266\340\355\306\265\360\356\277\323`\357\257\322p\360\237\265`\361\217\264p\362\177\227`\363o\226p\364_y`\365Oxp\366?[`\367/Zp\370(w\340\371\17<p\372\10Y\340\372\370X\360\373\350;\340\374\330:\360\375\310\35\340\376\270\34\360\377\247\377\340\0\227\376\360\1\207\341\340\2w\340\360\3p\376`\4`\375p\5P\340`\6@\337p\0070\302`\7\215\31p\t\20\244`\t\255\224\360\n\360\206`\v\340\205p\f\331\242\340\r\300gp\16\271\204\340\17\251\203\360\20\231f\340"..., 4096) = 3519
>lseek(5, -2252, SEEK_CUR)               = 1267
>read(5, "TZif2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0\0\0\0\0\354\0\0\0\5\0\0\0\24\377\377\377\377^\3\360\220\377\377\377\377\236\246\36p\377\377\377\377\237\272\353`\377\377\377\377\240\206\0p\377\377\377\377\241\232\315`\377\377\377\377\242e\342p\377\377\377\377\243\203\351\340\377\377\377\377\244j\256p\377\377\377\377\2455\247`\377\377\377\377\246S\312\360\377\377\377\377\247\25\211`\377\377\377\377\2503\254\360\377\377\377\377\250\376\245\340\377\377\377\377\252\23\216\360\377\377\377\377\252\336\207\340\377\377\377\377\253\363p\360\377\377\377\377\254\276i\340\377\377\377\377\255\323R\360\377\377\377\377\256\236K\340\377\377\377\377\257\2634\360\377\377\377\377\260~-\340\377\377\377\377\261\234Qp\377\377\377\377\262gJ`\377\377\377\377\263|3p\377\377\377\377\264G,`\377\377\377\377\265\\\25p\377\377\377\377\266'\16`\377\377\377\377\267;\367p\377\377\377\377\270\6\360`\377\377\377\377\271\33\331p\377\377\377\377\271\346\322`\377\377\377\377\273\4\365\360\377\377\377\377\273\306\264`\377\377\377\377\274\344\327\360\377\377\377\377\275\257\320\340\377\377\377\377\276\304\271\360\377\377\377\377\277\217\262\340\377\377\377\377\300\244\233\360\377\377\377\377\301o\224\340\377\377\377\377\302\204}\360\377\377\377\377\303Ov\340\377\377\377\377\304d_\360\377\377\377\377\305/X\340\377\377\377\377\306M|p\377\377\377\377\307\17:\340\377\377\377\377\310-^p\377\377\377\377\310\370W`\377\377\377\377\312\r@p\377\377\377\377\312\3309`\377\377\377\377\313\210\360p\377\377\377\377\322#\364p\377\377\377\377\322`\373\340\377\377\377\377\323u\344\360\377\377\377\377\324@\335\340\377\377\377\377\325U\306\360\377\377\377\377\326 \277\340\377\377\377\377\3275\250\360\377\377\377\377\330\0\241\340\377\377\377\377"..., 4096) = 2252
>lseek(5, 3518, SEEK_SET)                = 3518
>close(5)                                = 0
>munmap(0x7f1f22a1c000, 4096)            = 0
>socket(PF_FILE, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 5
>connect(5, {sa_family=AF_FILE, sun_path="/dev/log"}, 110) = 0
>sendto(5, "<30>Feb 12 18:05:36 auditd[3254]: Started dispatcher: /sbin/audispd pid: 3256", 77, MSG_NOSIGNAL, NULL, 0) = 77
>uname({sys="Linux", node="localhost.localdomain", ...}) = 0
>open("/proc/3254/attr/current", O_RDONLY) = 7
>read(7, "unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023\0", 4096) = 50
>close(7)                                = 0
>open("/proc/self/loginuid", O_RDONLY|O_NOFOLLOW) = 7
>read(7, "0", 16)                        = 1
>close(7)                                = 0
>gettimeofday({1360710336, 652328}, NULL) = 0
>writev(6, [{"\0\0\0\0\20\0\0\0\260\4\0\0\256\0\0\0", 16}, {"audit(1360710336.652:1473): auditd start, ver=2.2.2 format=raw kernel=3.7.6-201.fc18.x86_64 auid=0 pid=3254 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 res=success", 174}], 2) = 190
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>nanosleep({0, 2000000}, NULL)           = 0
>open("/proc/self/oom_score_adj", O_WRONLY|O_NOFOLLOW) = 7
>write(7, "-1000", 5)                    = 5
>close(7)                                = 0
>sendto(3, "0\0\0\0\351\3\5\0\1\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\266\f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 48, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 48
>poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
>recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\266\f\0\0\0\0\0\0000\0\0\0\351\3\5\0\1\0\0\0\0\0\0\0", 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
>recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\266\f\0\0\0\0\0\0000\0\0\0\351\3\5\0\1\0\0\0\0\0\0\0", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
>poll([{fd=3, events=POLLIN}], 1, 100)   = 0 (Timeout)
>recvfrom(3, 0x7fff24b1f620, 8988, 64, 0x7fff24b1f590, 0x7fff24b1f58c) = -1 EAGAIN (Resource temporarily unavailable)
>sendto(3, "\20\0\0\0\350\3\5\0\2\0\0\0\0\0\0\0", 16, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 16
>poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
>recvfrom(3, "$\0\0\0\2\0\0\0\2\0\0\0\266\f\0\0\0\0\0\0\20\0\0\0\350\3\5\0\2\0\0\0\0\0\0\0", 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
>recvfrom(3, "$\0\0\0\2\0\0\0\2\0\0\0\266\f\0\0\0\0\0\0\20\0\0\0\350\3\5\0\2\0\0\0\0\0\0\0", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
>poll([{fd=3, events=POLLIN}], 1, 100)   = 1 ([{fd=3, revents=POLLIN}])
>recvfrom(3, "0\0\0\0\350\3\0\0\2\0\0\0\266\f\0\0\0\0\0\0\1\0\0\0\1\0\0\0\266\f\0\0\0\0\0\0@\1\0\0A\0\0\0\0\0\0\0", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 48
>sendto(3, "0\0\0\0\351\3\5\0\3\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 48, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 48
>poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
>recvfrom(3, "$\0\0\0\2\0\0\0\3\0\0\0\266\f\0\0\0\0\0\0000\0\0\0\351\3\5\0\3\0\0\0\0\0\0\0", 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
>recvfrom(3, "$\0\0\0\2\0\0\0\3\0\0\0\266\f\0\0\0\0\0\0000\0\0\0\351\3\5\0\3\0\0\0\0\0\0\0", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
>clock_gettime(CLOCK_MONOTONIC, {10271, 970751700}) = 0
>gettimeofday({1360710336, 759435}, NULL) = 0
>clock_gettime(CLOCK_MONOTONIC, {10271, 970809134}) = 0
>epoll_create1(EPOLL_CLOEXEC)            = 7
>fcntl(7, F_SETFD, FD_CLOEXEC)           = 0
>eventfd2(0, O_NONBLOCK|O_CLOEXEC)       = 8
>fcntl(8, F_SETFD, FD_CLOEXEC)           = 0
>fcntl(8, F_SETFL, O_RDONLY|O_NONBLOCK)  = 0
>rt_sigaction(SIGCHLD, {0x7f1f22a31190, ~[RTMIN RT_1], SA_RESTORER|SA_RESTART, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGTERM, {0x7f1f22a31190, ~[RTMIN RT_1], SA_RESTORER|SA_RESTART, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGHUP, {0x7f1f22a31190, ~[RTMIN RT_1], SA_RESTORER|SA_RESTART, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGUSR1, {0x7f1f22a31190, ~[RTMIN RT_1], SA_RESTORER|SA_RESTART, 0x7f1f221ce000}, NULL, 8) = 0
>rt_sigaction(SIGUSR2, {0x7f1f22a31190, ~[RTMIN RT_1], SA_RESTORER|SA_RESTART, 0x7f1f221ce000}, NULL, 8) = 0
>sendto(5, "<29>Feb 12 18:05:36 auditd[3254]: Init complete, auditd 2.2.2 listening for events (startup state enable)", 105, MSG_NOSIGNAL, NULL, 0) = 105
>epoll_ctl(7, EPOLL_CTL_ADD, 8, {...})   = 0
>epoll_ctl(7, EPOLL_CTL_ADD, 3, {...})   = 0
>clock_gettime(CLOCK_MONOTONIC, {10271, 971313270}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 971371361}) = 0
>recvfrom(3, "w\0\0\0\31\5\0\0\0\0\0\0\0\0\0\0audit(1360706634.601:529): audit_pid=0 old=2763 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 135
>writev(6, [{"\0\0\0\0\20\0\0\0\31\5\0\0w\0\0\0", 16}, {"audit(1360706634.601:529): audit_pid=0 old=2763 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1", 119}], 2) = 135
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 971615690}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 971673824}) = 0
>recvfrom(3, "\311\0\0\0k\4\0\0\0\0\0\0\1\0\0\0audit(1360706634.653:530): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"auditd-strace\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=failed'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 217
>writev(6, [{"\0\0\0\0\20\0\0\0k\4\0\0\311\0\0\0", 16}, {"audit(1360706634.653:530): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"auditd-strace\" exe=\"/usr/lib/systemd/systemd\" hostname=? addr=? terminal=? res=failed'", 201}], 2) = 217
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 971899451}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 971957317}) = 0
>recvfrom(3, "\334\0\0\0M\4\0\0\0\0\0\0Y\f\0\0audit(1360710061.215:531): pid=3161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 236
>writev(6, [{"\0\0\0\0\20\0\0\0M\4\0\0\334\0\0\0", 16}, {"audit(1360710061.215:531): pid=3161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 220}], 2) = 236
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 972223316}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 972324168}) = 0
>recvfrom(3, "\331\0\0\0O\4\0\0\0\0\0\0Y\f\0\0audit(1360710061.223:532): pid=3161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 233
>writev(6, [{"\0\0\0\0\20\0\0\0O\4\0\0\331\0\0\0", 16}, {"audit(1360710061.223:532): pid=3161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 217}], 2) = 233
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 972555505}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 972612841}) = 0
>recvfrom(3, "k\0\0\0\356\3\0\0\0\0\0\0\0\0\0\0audit(1360710061.228:533): login pid=3161 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 123
>writev(6, [{"\0\0\0\0\20\0\0\0\356\3\0\0k\0\0\0", 16}, {"audit(1360710061.228:533): login pid=3161 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6", 107}], 2) = 123
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 972831937}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 972888789}) = 0
>recvfrom(3, "\314\0\0\0Q\4\0\0\0\0\0\0Y\f\0\0audit(1360710061.422:534): pid=3161 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 220
>writev(6, [{"\0\0\0\0\20\0\0\0Q\4\0\0\314\0\0\0", 16}, {"audit(1360710061.422:534): pid=3161 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 204}], 2) = 220
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 973138334}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 973194360}) = 0
>recvfrom(3, "\307\0\0\0V\4\0\0\0\0\0\0Y\f\0\0audit(1360710061.430:535): pid=3161 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 215
>writev(6, [{"\0\0\0\0\20\0\0\0V\4\0\0\307\0\0\0", 16}, {"audit(1360710061.430:535): pid=3161 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 199}], 2) = 215
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 973439190}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 973467330}) = 0
>recvfrom(3, "\307\0\0\0P\4\0\0\0\0\0\0Y\f\0\0audit(1360710061.472:536): pid=3161 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 215
>writev(6, [{"\0\0\0\0\20\0\0\0P\4\0\0\307\0\0\0", 16}, {"audit(1360710061.472:536): pid=3161 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 199}], 2) = 215
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 973579121}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 973607126}) = 0
>recvfrom(3, "\315\0\0\0R\4\0\0\0\0\0\0Y\f\0\0audit(1360710061.485:537): pid=3161 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 221
>writev(6, [{"\0\0\0\0\20\0\0\0R\4\0\0\315\0\0\0", 16}, {"audit(1360710061.485:537): pid=3161 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/crond\" hostname=? addr=? terminal=cron res=success'", 205}], 2) = 221
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 973722302}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 973749949}) = 0
>recvfrom(3, "+\1\0\0d\t\0\0\0\0\0\0m\f\0\0audit(1360710088.929:538): pid=3181 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=7a:b2:0d:ea:16:28:07:29:fe:d4:6e:57:da:f2:d3:f8 direction=? spid=3181 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 315
>writev(6, [{"\0\0\0\0\20\0\0\0d\t\0\0+\1\0\0", 16}, {"audit(1360710088.929:538): pid=3181 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=7a:b2:0d:ea:16:28:07:29:fe:d4:6e:57:da:f2:d3:f8 direction=? spid=3181 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 299}], 2) = 315
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 973863009}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 973890207}) = 0
>recvfrom(3, "+\1\0\0d\t\0\0\0\0\0\0m\f\0\0audit(1360710088.936:539): pid=3181 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:97:88:28:92:23:e1:da:cc:f0:68:06:c9:2c:64:16 direction=? spid=3181 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 315
>writev(6, [{"\0\0\0\0\20\0\0\0d\t\0\0+\1\0\0", 16}, {"audit(1360710088.936:539): pid=3181 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:97:88:28:92:23:e1:da:cc:f0:68:06:c9:2c:64:16 direction=? spid=3181 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 299}], 2) = 315
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974001804}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974049376}) = 0
>recvfrom(3, ":\1\0\0g\t\0\0\0\0\0\0l\f\0\0audit(1360710088.950:540): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=3181 suid=74 rport=37359 laddr=10.13.137.120 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 330
>writev(6, [{"\0\0\0\0\20\0\0\0g\t\0\0:\1\0\0", 16}, {"audit(1360710088.950:540): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=3181 suid=74 rport=37359 laddr=10.13.137.120 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 314}], 2) = 330
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974181059}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974202349}) = 0
>recvfrom(3, ":\1\0\0g\t\0\0\0\0\0\0l\f\0\0audit(1360710088.962:541): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=3181 suid=74 rport=37359 laddr=10.13.137.120 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 330
>writev(6, [{"\0\0\0\0\20\0\0\0g\t\0\0:\1\0\0", 16}, {"audit(1360710088.962:541): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=3181 suid=74 rport=37359 laddr=10.13.137.120 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 314}], 2) = 330
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974422495}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974454407}) = 0
>recvfrom(3, "\352\0\0\0L\4\0\0\0\0\0\0l\f\0\0audit(1360710089.808:542): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=37359 acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 250
>writev(6, [{"\0\0\0\0\20\0\0\0L\4\0\0\352\0\0\0", 16}, {"audit(1360710089.808:542): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=37359 acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 234}], 2) = 250
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974566146}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974594325}) = 0
>recvfrom(3, ",\1\0\0L\4\0\0\0\0\0\0l\f\0\0audit(1360710089.815:543): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=a6:cc:e3:90:1f:51:4c:9f:ff:fe:c7:94:e9:5d:89:87 rport=37359 acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 316
>writev(6, [{"\0\0\0\0\20\0\0\0L\4\0\0,\1\0\0", 16}, {"audit(1360710089.815:543): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=a6:cc:e3:90:1f:51:4c:9f:ff:fe:c7:94:e9:5d:89:87 rport=37359 acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 300}], 2) = 316
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974706243}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974733895}) = 0
>recvfrom(3, "\373\0\0\0M\4\0\0\0\0\0\0l\f\0\0audit(1360710089.827:544): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 267
>writev(6, [{"\0\0\0\0\20\0\0\0M\4\0\0\373\0\0\0", 16}, {"audit(1360710089.827:544): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 251}], 2) = 267
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974857209}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974881204}) = 0
>recvfrom(3, "+\1\0\0d\t\0\0\0\0\0\0l\f\0\0audit(1360710089.835:545): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3181 suid=74 rport=37359 laddr=10.13.137.120 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 315
>writev(6, [{"\0\0\0\0\20\0\0\0d\t\0\0+\1\0\0", 16}, {"audit(1360710089.835:545): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3181 suid=74 rport=37359 laddr=10.13.137.120 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 299}], 2) = 315
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 974993508}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 975050017}) = 0
>recvfrom(3, "\334\0\0\0L\4\0\0\0\0\0\0l\f\0\0audit(1360710089.844:546): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 236
>writev(6, [{"\0\0\0\0\20\0\0\0L\4\0\0\334\0\0\0", 16}, {"audit(1360710089.844:546): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=ssh res=success'", 220}], 2) = 236
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 975197241}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 975225434}) = 0
>recvfrom(3, "\370\0\0\0O\4\0\0\0\0\0\0l\f\0\0audit(1360710089.850:547): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 264
>writev(6, [{"\0\0\0\0\20\0\0\0O\4\0\0\370\0\0\0", 16}, {"audit(1360710089.850:547): pid=3180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 248}], 2) = 264
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 975399694}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10271, 975431984}) = 0
>recvfrom(3, "k\0\0\0\356\3\0\0\0\0\0\0\0\0\0\0audit(1360710089.855:548): login pid=3180 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 123
>writev(6, [{"\0\0\0\0\20\0\0\0\356\3\0\0k\0\0\0", 16}, {"audit(1360710089.855:548): login pid=3180 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7", 107}], 2) = 123
>futex(0x7f1f22c43208, FUTEX_WAIT_PRIVATE, 2, NULL) = 0
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 30349438}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 30409933}) = 0
>recvfrom(3, "]\1\0\0\374\10\0\0\0\0\0\0l\f\0\0audit(1360710089.893:549): pid=3180 uid=0 auid=0 ses=7 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 365
>writev(6, [{"\0\0\0\0\20\0\0\0\374\10\0\0]\1\0\0", 16}, {"audit(1360710089.893:549): pid=3180 uid=0 auid=0 ses=7 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 349}], 2) = 365
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 30653644}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 30705818}) = 0
>recvfrom(3, "\353\0\0\0Q\4\0\0\0\0\0\0l\f\0\0audit(1360710089.971:550): pid=3180 uid=0 auid=0 ses=7 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 251
>writev(6, [{"\0\0\0\0\20\0\0\0Q\4\0\0\353\0\0\0", 16}, {"audit(1360710089.971:550): pid=3180 uid=0 auid=0 ses=7 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 235}], 2) = 251
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 30938369}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 30992792}) = 0
>recvfrom(3, "\347\0\0\0X\4\0\0\0\0\0\0l\f\0\0audit(1360710090.032:551): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 247
>writev(6, [{"\0\0\0\0\20\0\0\0X\4\0\0\347\0\0\0", 16}, {"audit(1360710090.032:551): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 231}], 2) = 247
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 31243596}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 31375326}) = 0
>recvfrom(3, "\347\0\0\0Q\4\0\0\0\0\0\0l\f\0\0audit(1360710090.033:552): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 247
>writev(6, [{"\0\0\0\0\20\0\0\0Q\4\0\0\347\0\0\0", 16}, {"audit(1360710090.033:552): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 231}], 2) = 247
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 31607116}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 31661258}) = 0
>recvfrom(3, "'\1\0\0d\t\0\0\0\0\0\0o\f\0\0audit(1360710090.035:553): pid=3183 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=7a:b2:0d:ea:16:28:07:29:fe:d4:6e:57:da:f2:d3:f8 direction=? spid=3183 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 311
>writev(6, [{"\0\0\0\0\20\0\0\0d\t\0\0'\1\0\0", 16}, {"audit(1360710090.035:553): pid=3183 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=7a:b2:0d:ea:16:28:07:29:fe:d4:6e:57:da:f2:d3:f8 direction=? spid=3183 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 295}], 2) = 311
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 31893676}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 31943077}) = 0
>recvfrom(3, "'\1\0\0d\t\0\0\0\0\0\0o\f\0\0audit(1360710090.035:554): pid=3183 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:97:88:28:92:23:e1:da:cc:f0:68:06:c9:2c:64:16 direction=? spid=3183 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 311
>writev(6, [{"\0\0\0\0\20\0\0\0d\t\0\0'\1\0\0", 16}, {"audit(1360710090.035:554): pid=3183 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:97:88:28:92:23:e1:da:cc:f0:68:06:c9:2c:64:16 direction=? spid=3183 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 295}], 2) = 311
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 32203923}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 32255742}) = 0
>recvfrom(3, "\364\0\0\0V\4\0\0\0\0\0\0o\f\0\0audit(1360710090.039:555): pid=3183 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 260
>writev(6, [{"\0\0\0\0\20\0\0\0V\4\0\0\364\0\0\0", 16}, {"audit(1360710090.039:555): pid=3183 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 244}], 2) = 260
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 32519969}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 32573111}) = 0
>recvfrom(3, "\347\0\0\0R\4\0\0\0\0\0\0l\f\0\0audit(1360710090.266:556): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 247
>writev(6, [{"\0\0\0\0\20\0\0\0R\4\0\0\347\0\0\0", 16}, {"audit(1360710090.266:556): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 231}], 2) = 247
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 32810154}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 32859871}) = 0
>recvfrom(3, "\347\0\0\0Y\4\0\0\0\0\0\0l\f\0\0audit(1360710090.268:557): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 247
>writev(6, [{"\0\0\0\0\20\0\0\0Y\4\0\0\347\0\0\0", 16}, {"audit(1360710090.268:557): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 231}], 2) = 247
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 33128541}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 33186125}) = 0
>recvfrom(3, "\372\0\0\0R\4\0\0\0\0\0\0l\f\0\0audit(1360710090.279:558): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 266
>writev(6, [{"\0\0\0\0\20\0\0\0R\4\0\0\372\0\0\0", 16}, {"audit(1360710090.279:558): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 250}], 2) = 266
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 33461650}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 33496441}) = 0
>recvfrom(3, "\364\0\0\0P\4\0\0\0\0\0\0l\f\0\0audit(1360710090.281:559): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 260
>writev(6, [{"\0\0\0\0\20\0\0\0P\4\0\0\364\0\0\0", 16}, {"audit(1360710090.281:559): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct=\"root\" exe=\"/usr/sbin/sshd\" hostname=vpn-51-21.rdu2.redhat.com addr=10.10.51.21 terminal=ssh res=success'", 244}], 2) = 260
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 33608461}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 33641103}) = 0
>recvfrom(3, "'\1\0\0d\t\0\0\0\0\0\0l\f\0\0audit(1360710090.283:560): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=7a:b2:0d:ea:16:28:07:29:fe:d4:6e:57:da:f2:d3:f8 direction=? spid=3180 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 311
>writev(6, [{"\0\0\0\0\20\0\0\0d\t\0\0'\1\0\0", 16}, {"audit(1360710090.283:560): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=7a:b2:0d:ea:16:28:07:29:fe:d4:6e:57:da:f2:d3:f8 direction=? spid=3180 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 295}], 2) = 311
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 33758495}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 33782849}) = 0
>recvfrom(3, "'\1\0\0d\t\0\0\0\0\0\0l\f\0\0audit(1360710090.283:561): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:97:88:28:92:23:e1:da:cc:f0:68:06:c9:2c:64:16 direction=? spid=3180 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 311
>writev(6, [{"\0\0\0\0\20\0\0\0d\t\0\0'\1\0\0", 16}, {"audit(1360710090.283:561): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=85:97:88:28:92:23:e1:da:cc:f0:68:06:c9:2c:64:16 direction=? spid=3180 suid=0  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 295}], 2) = 311
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 33891377}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 33919172}) = 0
>recvfrom(3, "&\1\0\0d\t\0\0\0\0\0\0l\f\0\0audit(1360710090.283:562): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3180 suid=0 rport=37359 laddr=10.13.137.120 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 310
>writev(6, [{"\0\0\0\0\20\0\0\0d\t\0\0&\1\0\0", 16}, {"audit(1360710090.283:562): pid=3180 uid=0 auid=0 ses=7 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3180 suid=0 rport=37359 laddr=10.13.137.120 lport=22  exe=\"/usr/sbin/sshd\" hostname=? addr=10.10.51.21 terminal=? res=success'", 294}], 2) = 310
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 34052966}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 34079060}) = 0
>recvfrom(3, "\307\0\0\0\355\3\0\0\0\0\0\0\263\f\0\0audit(1360710334.682:563): pid=3251 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 msg='BEFORE HAND exe=\"/usr/sbin/auditctl\" hostname=? addr=? terminal=pts/1 res=success'", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 215
>writev(6, [{"\0\0\0\0\20\0\0\0\355\3\0\0\307\0\0\0", 16}, {"audit(1360710334.682:563): pid=3251 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:auditctl_t:s0-s0:c0.c1023 msg='BEFORE HAND exe=\"/usr/sbin/auditctl\" hostname=? addr=? terminal=pts/1 res=success'", 199}], 2) = 215
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 34194286}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 34217465}) = 0
>recvfrom(3, "y\0\0\0\31\5\0\0\0\0\0\0\0\0\0\0audit(1360710336.654:564): audit_pid=3254 old=0 auid=0 ses=2 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 res=1", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 137
>writev(6, [{"\0\0\0\0\20\0\0\0\31\5\0\0y\0\0\0", 16}, {"audit(1360710336.654:564): audit_pid=3254 old=0 auid=0 ses=2 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 res=1", 121}], 2) = 137
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 34418428}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 34449691}) = 0
>recvfrom(3, "z\0\0\0\31\5\0\0\0\0\0\0\0\0\0\0audit(1360710336.758:565): audit_enabled=1 old=1 auid=0 ses=2 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 res=1", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 138
>writev(6, [{"\0\0\0\0\20\0\0\0\31\5\0\0z\0\0\0", 16}, {"audit(1360710336.758:565): audit_enabled=1 old=1 auid=0 ses=2 subj=unconfined_u:system_r:unconfined_t:s0-s0:c0.c1023 res=1", 122}], 2) = 138
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>clock_gettime(CLOCK_MONOTONIC, {10272, 34568308}) = 0
>epoll_wait(7, 7f1f24682c20, 64, 59743)  = -1 EINTR (Interrupted system call)
>--- SIGTERM {si_signo=SIGTERM, si_code=SI_USER, si_pid=3260, si_uid=0} ---
>write(8, "\1\0\0\0\0\0\0\0", 8)         = 8
>rt_sigreturn()                          = -1 EINTR (Interrupted system call)
>clock_gettime(CLOCK_MONOTONIC, {10276, 747798012}) = 0
>gettimeofday({1360710341, 536466}, NULL) = 0
>clock_gettime(CLOCK_MONOTONIC, {10276, 747826986}) = 0
>epoll_wait(7, {?} 0x7f1f24682c20, 64, 59743) = 1
>clock_gettime(CLOCK_MONOTONIC, {10276, 747857375}) = 0
>read(8, "\1\0\0\0\0\0\0\0", 8)          = 8
>close(0)                                = 0
>rt_sigaction(SIGHUP, {SIG_DFL, [HUP], SA_RESTORER|SA_RESTART, 0x7f1f2140bc20}, {0x7f1f22a31190, ~[KILL STOP RTMIN RT_1], SA_RESTORER|SA_RESTART, 0x7f1f221ce000}, 8) = 0
>rt_sigaction(SIGUSR1, {SIG_DFL, [USR1], SA_RESTORER|SA_RESTART, 0x7f1f2140bc20}, {0x7f1f22a31190, ~[KILL STOP RTMIN RT_1], SA_RESTORER|SA_RESTART, 0x7f1f221ce000}, 8) = 0
>rt_sigaction(SIGUSR2, {SIG_DFL, [USR2], SA_RESTORER|SA_RESTART, 0x7f1f2140bc20}, {0x7f1f22a31190, ~[KILL STOP RTMIN RT_1], SA_RESTORER|SA_RESTART, 0x7f1f221ce000}, 8) = 0
>rt_sigaction(SIGTERM, {SIG_DFL, [TERM], SA_RESTORER|SA_RESTART, 0x7f1f2140bc20}, {0x7f1f22a31190, ~[KILL STOP RTMIN RT_1], SA_RESTORER|SA_RESTART, 0x7f1f221ce000}, 8) = 0
>sendto(3, "\20\0\0\0\362\3\5\0\4\0\0\0\0\0\0\0", 16, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 16
>poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
>recvfrom(3, "$\0\0\0\2\0\0\0\4\0\0\0\266\f\0\0\0\0\0\0\20\0\0\0\362\3\5\0\4\0\0\0\0\0\0\0", 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
>recvfrom(3, "$\0\0\0\2\0\0\0\4\0\0\0\266\f\0\0\0\0\0\0\20\0\0\0\362\3\5\0\4\0\0\0\0\0\0\0", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
>select(4, [3], NULL, NULL, {0, 100000}) = 1 (in [3], left {0, 99998})
>recvfrom(3, "N\0\0\0\362\3\0\0\4\0\0\0\266\f\0\0\0\0\0\0\274\f\0\0unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023\0\0\0", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 80
>gettimeofday({1360710341, 538496}, NULL) = 0
>writev(6, [{"\0\0\0\0\20\0\0\0\261\4\0\0\216\0\0\0", 16}, {"audit(1360710341.538:1474): auditd normal halt, sending auid=0 pid=3260 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 res=success", 142}], 2) = 158
>futex(0x7f1f22c43234, FUTEX_WAKE_OP_PRIVATE, 1, 1, 0x7f1f22c43230, {FUTEX_OP_SET, 0, FUTEX_OP_CMP_GT, 1}) = 1
>futex(0x7f1f22c43208, FUTEX_WAKE_PRIVATE, 1) = 1
>nanosleep({0, 2000000}, NULL)           = 0
>nanosleep({0, 10000000}, NULL)          = 0
>kill(3256, SIGTERM)                     = 0
>close(6)                                = 0
>rt_sigaction(SIGALRM, {0x7f1f22a285a0, [], SA_RESTORER, 0x7f1f221ce000}, NULL, 8) = 0
>alarm(5)                                = 0
>close(4)                                = 0
>munmap(0x7f1f22a1d000, 4096)            = 0
>rt_sigaction(SIGCHLD, {SIG_DFL, [CHLD], SA_RESTORER|SA_RESTART, 0x7f1f2140bc20}, {0x7f1f22a31190, ~[KILL STOP RTMIN RT_1], SA_RESTORER|SA_RESTART, 0x7f1f221ce000}, 8) = 0
>close(8)                                = 0
>close(7)                                = 0
>sendto(5, "<30>Feb 12 18:05:41 auditd[3254]: The audit daemon is exiting.", 62, MSG_NOSIGNAL, NULL, 0) = 62
>sendto(3, "0\0\0\0\351\3\5\0\5\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 48, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 48
>poll([{fd=3, events=POLLIN}], 1, 500)   = 1 ([{fd=3, revents=POLLIN}])
>recvfrom(3, "$\0\0\0\2\0\0\0\5\0\0\0\266\f\0\0\0\0\0\0000\0\0\0\351\3\5\0\5\0\0\0\0\0\0\0", 8988, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
>recvfrom(3, "$\0\0\0\2\0\0\0\5\0\0\0\266\f\0\0\0\0\0\0000\0\0\0\351\3\5\0\5\0\0\0\0\0\0\0", 8988, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36
>close(3)                                = 0
>unlink("/var/run/auditd.pid")           = 0
>close(5)                                = 0
>exit_group(0)                           = ?
>+++ exited with 0 +++

Actions: View

Attachments on bug 910568: 696620 | 696621 | 696646 | 696649