Attachment 888379 Details for Bug 1083566 – the audit log during launch of instances.

the audit log during launch of instances.

audit.log (text/x-log), 26.35 KB, created by Yogev Rabl on 2014-04-22 08:01:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Yogev Rabl

Created: 2014-04-22 08:01:47 UTC

Size: 26.35 KB

patch

obsolete

>type=DAEMON_START msg=audit(1398153305.982:4489): auditd start, ver=2.3.3 format=raw kernel=3.10.0-121.el7.x86_64 auid=4294967295 pid=467 subj=system_u:system_r:auditd_t:s0 res=success
>type=SERVICE_START msg=audit(1398153306.046:18): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="auditd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1398153352.880:19): pid=518 uid=165 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E6620656E76204C435F414C4C3D4320766773202D2D6E6F68656164696E6773202D2D756E69743D67202D6F206E616D652C73697A652C667265652C6C765F636F756E742C75756964202D2D736570617261746F72203A202D2D6E6F7375666669782063696E6465722D766F6C756D6573 terminal=? res=success'
>type=CRED_ACQ msg=audit(1398153352.880:20): pid=518 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1398153352.881:21): pid=518 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1398153352.956:22): pid=518 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1398153352.956:23): pid=518 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1398153361.876:24): pid=526 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1398153361.876:25): pid=526 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1398153361.877:26): pid=526 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=360 res=1
>type=USER_START msg=audit(1398153361.890:27): pid=526 uid=0 auid=0 ses=360 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1398153361.891:28): pid=526 uid=0 auid=0 ses=360 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1398153362.501:29): pid=526 uid=0 auid=0 ses=360 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1398153362.503:30): pid=526 uid=0 auid=0 ses=360 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_CMD msg=audit(1398153412.887:31): pid=981 uid=165 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E6620656E76204C435F414C4C3D4320766773202D2D6E6F68656164696E6773202D2D756E69743D67202D6F206E616D652C73697A652C667265652C6C765F636F756E742C75756964202D2D736570617261746F72203A202D2D6E6F7375666669782063696E6465722D766F6C756D6573 terminal=? res=success'
>type=CRED_ACQ msg=audit(1398153412.887:32): pid=981 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1398153412.889:33): pid=981 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1398153412.968:34): pid=981 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1398153412.968:35): pid=981 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1398153421.515:36): pid=1051 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1398153421.516:37): pid=1051 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1398153421.518:38): pid=1051 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=361 res=1
>type=USER_START msg=audit(1398153421.585:39): pid=1051 uid=0 auid=0 ses=361 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1398153421.586:40): pid=1051 uid=0 auid=0 ses=361 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1398153422.197:41): pid=1051 uid=0 auid=0 ses=361 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1398153422.199:42): pid=1051 uid=0 auid=0 ses=361 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_CMD msg=audit(1398153472.893:43): pid=1123 uid=165 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E6620656E76204C435F414C4C3D4320766773202D2D6E6F68656164696E6773202D2D756E69743D67202D6F206E616D652C73697A652C667265652C6C765F636F756E742C75756964202D2D736570617261746F72203A202D2D6E6F7375666669782063696E6465722D766F6C756D6573 terminal=? res=success'
>type=CRED_ACQ msg=audit(1398153472.893:44): pid=1123 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1398153472.894:45): pid=1123 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1398153472.968:46): pid=1123 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1398153472.968:47): pid=1123 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1398153481.208:48): pid=1150 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1398153481.208:49): pid=1150 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1398153481.209:50): pid=1150 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=362 res=1
>type=USER_START msg=audit(1398153481.220:51): pid=1150 uid=0 auid=0 ses=362 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1398153481.221:52): pid=1150 uid=0 auid=0 ses=362 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1398153481.830:53): pid=1150 uid=0 auid=0 ses=362 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1398153481.833:54): pid=1150 uid=0 auid=0 ses=362 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_CMD msg=audit(1398153532.897:55): pid=1265 uid=165 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E6620656E76204C435F414C4C3D4320766773202D2D6E6F68656164696E6773202D2D756E69743D67202D6F206E616D652C73697A652C667265652C6C765F636F756E742C75756964202D2D736570617261746F72203A202D2D6E6F7375666669782063696E6465722D766F6C756D6573 terminal=? res=success'
>type=CRED_ACQ msg=audit(1398153532.898:56): pid=1265 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1398153532.899:57): pid=1265 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1398153532.970:58): pid=1265 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1398153532.970:59): pid=1265 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1398153541.842:60): pid=1290 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1398153541.842:61): pid=1290 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1398153541.842:62): pid=1290 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=363 res=1
>type=USER_START msg=audit(1398153541.853:63): pid=1290 uid=0 auid=0 ses=363 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1398153541.854:64): pid=1290 uid=0 auid=0 ses=363 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1398153542.465:65): pid=1290 uid=0 auid=0 ses=363 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1398153542.467:66): pid=1290 uid=0 auid=0 ses=363 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_CMD msg=audit(1398153592.899:67): pid=1385 uid=165 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E6620656E76204C435F414C4C3D4320766773202D2D6E6F68656164696E6773202D2D756E69743D67202D6F206E616D652C73697A652C667265652C6C765F636F756E742C75756964202D2D736570617261746F72203A202D2D6E6F7375666669782063696E6465722D766F6C756D6573 terminal=? res=success'
>type=CRED_ACQ msg=audit(1398153592.899:68): pid=1385 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1398153592.899:69): pid=1385 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1398153592.970:70): pid=1385 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1398153592.970:71): pid=1385 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1398153601.475:72): pid=1406 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1398153601.475:73): pid=1405 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1398153601.475:74): pid=1406 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1398153601.475:75): pid=1405 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1398153601.475:76): pid=1406 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=364 res=1
>type=LOGIN msg=audit(1398153601.475:77): pid=1405 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=365 res=1
>type=USER_START msg=audit(1398153601.492:78): pid=1406 uid=0 auid=0 ses=364 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1398153601.493:79): pid=1405 uid=0 auid=0 ses=365 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1398153601.493:80): pid=1406 uid=0 auid=0 ses=364 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1398153601.493:81): pid=1405 uid=0 auid=0 ses=365 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1398153601.506:82): pid=1405 uid=0 auid=0 ses=365 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1398153601.509:83): pid=1405 uid=0 auid=0 ses=365 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1398153602.109:84): pid=1406 uid=0 auid=0 ses=364 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1398153602.110:85): pid=1406 uid=0 auid=0 ses=364 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1398153639.886:86): pid=1490 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=9b:0d:90:c9:e3:6d:14:37:94:65:f3:b7:37:89:b5:2a direction=? spid=1490 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1398153639.886:87): pid=1490 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=30:5d:8c:58:19:47:d6:d4:58:f2:07:6d:4b:2d:14:02 direction=? spid=1490 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1398153639.887:88): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=1490 suid=74 rport=35263 laddr=10. exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1398153639.888:89): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=1490 suid=74 rport=35263 laddr=10. exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=USER_LOGIN msg=audit(1398153639.940:90): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct=28756E6B6E6F776E207573657229 exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1398153643.888:91): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="?" exe="/usr/sbin/sshd" hostname=dhcp-2-229.tlv.redhat.com addr=10.35.2.229 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1398153643.889:92): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct=28696E76616C6964207573657229 exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1398153649.237:93): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="?" exe="/usr/sbin/sshd" hostname=dhcp-2-229.tlv.redhat.com addr=10.35.2.229 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1398153649.237:94): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct=28696E76616C6964207573657229 exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=ssh res=failed'
>type=CRYPTO_KEY_USER msg=audit(1398153650.075:95): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1490 suid=74 rport=35263 laddr=10.35.160.113 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1398153650.076:96): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=9b:0d:90:c9:e3:6d:14:37:94:65:f3:b7:37:89:b5:2a direction=? spid=1489 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1398153650.076:97): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=30:5d:8c:58:19:47:d6:d4:58:f2:07:6d:4b:2d:14:02 direction=? spid=1489 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=USER_LOGIN msg=audit(1398153650.076:98): pid=1489 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct=28696E76616C6964207573657229 exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=ssh res=failed'
>type=USER_CMD msg=audit(1398153652.906:99): pid=1514 uid=165 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E6620656E76204C435F414C4C3D4320766773202D2D6E6F68656164696E6773202D2D756E69743D67202D6F206E616D652C73697A652C667265652C6C765F636F756E742C75756964202D2D736570617261746F72203A202D2D6E6F7375666669782063696E6465722D766F6C756D6573 terminal=? res=success'
>type=CRED_ACQ msg=audit(1398153652.907:100): pid=1514 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1398153652.908:101): pid=1514 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1398153652.983:102): pid=1514 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1398153652.983:103): pid=1514 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1398153654.443:104): pid=1523 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=9b:0d:90:c9:e3:6d:14:37:94:65:f3:b7:37:89:b5:2a direction=? spid=1523 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1398153654.443:105): pid=1523 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=30:5d:8c:58:19:47:d6:d4:58:f2:07:6d:4b:2d:14:02 direction=? spid=1523 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1398153654.444:106): pid=1522 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=1523 suid=74 rport=35286 laddr=10. exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1398153654.444:107): pid=1522 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=1523 suid=74 rport=35286 laddr=10. exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=USER_AUTH msg=audit(1398153654.503:108): pid=1522 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1398153654.503:109): pid=1522 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1398153656.096:110): pid=1522 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=dhcp-2-229.tlv.redhat.com addr=10.35.2.229 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1398153656.100:111): pid=1522 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=dhcp-2-229.tlv.redhat.com addr=10.35.2.229 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1398153656.101:112): pid=1522 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1523 suid=74 rport=35286 laddr=10.35.160.113 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=USER_AUTH msg=audit(1398153656.102:113): pid=1522 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1398153656.104:114): pid=1522 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=dhcp-2-229.tlv.redhat.com addr=10.35.2.229 terminal=ssh res=success'
>type=LOGIN msg=audit(1398153656.104:115): pid=1522 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=366 res=1
>type=USER_ROLE_CHANGE msg=audit(1398153656.181:116): pid=1522 uid=0 auid=0 ses=366 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=dhcp-2-229.tlv.redhat.com addr=10.35.2.229 terminal=ssh res=success'
>type=USER_START msg=audit(1398153656.198:117): pid=1522 uid=0 auid=0 ses=366 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=dhcp-2-229.tlv.redhat.com addr=10.35.2.229 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1398153656.202:118): pid=1522 uid=0 auid=0 ses=366 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=dhcp-2-229.tlv.redhat.com addr=10.35.2.229 terminal=ssh res=success'
>type=USER_START msg=audit(1398153656.203:119): pid=1522 uid=0 auid=0 ses=366 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=dhcp-2-229.tlv.redhat.com addr=10.35.2.229 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1398153656.205:120): pid=1528 uid=0 auid=0 ses=366 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=9b:0d:90:c9:e3:6d:14:37:94:65:f3:b7:37:89:b5:2a direction=? spid=1528 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1398153656.205:121): pid=1528 uid=0 auid=0 ses=366 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=30:5d:8c:58:19:47:d6:d4:58:f2:07:6d:4b:2d:14:02 direction=? spid=1528 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.2.229 terminal=? res=success'
>type=CRED_REFR msg=audit(1398153656.207:122): pid=1528 uid=0 auid=0 ses=366 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=dhcp-2-229.tlv.redhat.com addr=10.35.2.229 terminal=ssh res=success'

Actions: View

Attachments on bug 1083566: 888379 | 888383 | 889074