Attachment 896468 Details for Bug 1098244 – audit.log from staypuft-installer

audit.log from staypuft-installer

mtaylor_staypuft-installer_audit.log (text/plain), 110.65 KB, created by Martyn Taylor on 2014-05-16 16:45:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Martyn Taylor

Created: 2014-05-16 16:45:14 UTC

Size: 110.65 KB

patch

obsolete

>type=DAEMON_START msg=audit(1400253264.157:3088): auditd start, ver=2.2 format=raw kernel=2.6.32-431.el6.x86_64 auid=4294967295 pid=895 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1400253264.269:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1400253287.644:5): user pid=1356 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1400253287.647:6): user pid=1356 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=LOGIN msg=audit(1400253287.648:7): pid=1356 uid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1400253287.780:8): user pid=1356 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_START msg=audit(1400253287.858:9): user pid=1356 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400253287.859:10): user pid=1356 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_LOGIN msg=audit(1400253287.861:11): user pid=1356 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_CMD msg=audit(1400253292.927:12): user pid=1463 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=73687574646F776E202D68206E6F77 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400253292.927:13): user pid=1463 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1400253292.929:14): user pid=1463 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=SYSTEM_RUNLEVEL msg=audit(1400253292.944:15): user pid=1464 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0 exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
>type=SYSTEM_SHUTDOWN msg=audit(1400253292.956:16): user pid=1464 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
>type=USER_END msg=audit(1400253292.963:17): user pid=1463 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400253292.964:18): user pid=1463 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400253292.969:19): user pid=1356 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_END msg=audit(1400253292.985:20): user pid=1356 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400253294.086:21): user pid=1196 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=1196 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400253294.088:22): user pid=1196 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=1196 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=DAEMON_END msg=audit(1400253298.156:3089): auditd normal halt, sending auid=0 pid=1644 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1400253407.501:8649): auditd start, ver=2.2 format=raw kernel=2.6.32-431.el6.x86_64 auid=4294967295 pid=905 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1400253407.612:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1400253419.206:5): user pid=1345 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1400253419.208:6): user pid=1345 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=LOGIN msg=audit(1400253419.209:7): pid=1345 uid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1400253419.316:8): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_START msg=audit(1400253419.420:9): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400253419.421:10): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_LOGIN msg=audit(1400253419.422:11): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_CMD msg=audit(1400253476.399:12): user pid=1453 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=696675702065746830 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400253476.399:13): user pid=1453 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1400253476.401:14): user pid=1453 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_END msg=audit(1400253476.500:15): user pid=1453 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400253476.501:16): user pid=1453 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_CMD msg=audit(1400253504.497:17): user pid=1477 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=73657269766365206E6574776F726B207374617274 terminal=tty1 res=failed'
>type=USER_CMD msg=audit(1400253509.712:18): user pid=1478 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=73657276696365206E6574776F726B207374617274 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400253509.712:19): user pid=1478 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1400253509.713:20): user pid=1478 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_END msg=audit(1400253510.022:21): user pid=1478 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400253510.022:22): user pid=1478 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_CMD msg=audit(1400253596.247:23): user pid=1722 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=73687574646F776E202D68206E6F77 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400253596.248:24): user pid=1722 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1400253596.248:25): user pid=1722 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=SYSTEM_RUNLEVEL msg=audit(1400253596.274:26): user pid=1723 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0 exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
>type=SYSTEM_SHUTDOWN msg=audit(1400253596.274:27): user pid=1723 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
>type=USER_END msg=audit(1400253596.293:28): user pid=1722 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400253596.293:29): user pid=1722 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400253596.298:30): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_END msg=audit(1400253596.313:31): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400253597.279:32): user pid=1187 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=1187 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400253597.279:33): user pid=1187 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=1187 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=DAEMON_END msg=audit(1400253601.229:8650): auditd normal halt, sending auid=0 pid=1903 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1400253623.706:7216): auditd start, ver=2.2 format=raw kernel=2.6.32-431.el6.x86_64 auid=4294967295 pid=903 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1400253623.815:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1400253641.514:5): user pid=1345 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1400253641.516:6): user pid=1345 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=LOGIN msg=audit(1400253641.517:7): pid=1345 uid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1400253641.631:8): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_START msg=audit(1400253641.697:9): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400253641.698:10): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_LOGIN msg=audit(1400253641.700:11): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_CMD msg=audit(1400253650.700:12): user pid=1454 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=696675702065746830 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400253650.700:13): user pid=1454 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1400253650.703:14): user pid=1454 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_END msg=audit(1400253650.790:15): user pid=1454 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400253650.790:16): user pid=1454 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_CMD msg=audit(1400253652.526:17): user pid=1478 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=696675702065746831 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400253652.526:18): user pid=1478 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1400253652.526:19): user pid=1478 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_END msg=audit(1400253652.596:20): user pid=1478 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400253652.596:21): user pid=1478 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=SYSTEM_RUNLEVEL msg=audit(1400253688.442:22): user pid=1505 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=6 exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
>type=SYSTEM_SHUTDOWN msg=audit(1400253688.443:23): user pid=1505 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_DISP msg=audit(1400253688.454:24): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_END msg=audit(1400253688.454:25): user pid=1345 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400253689.442:26): user pid=1187 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=1187 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400253689.442:27): user pid=1187 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=1187 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=DAEMON_END msg=audit(1400253693.400:7217): auditd normal halt, sending auid=0 pid=1685 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1400253722.644:8809): auditd start, ver=2.2 format=raw kernel=2.6.32-431.el6.x86_64 auid=4294967295 pid=1081 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1400253722.767:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1400253785.739:5): user pid=1517 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1400253785.741:6): user pid=1517 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=LOGIN msg=audit(1400253785.742:7): pid=1517 uid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1400253785.851:8): user pid=1517 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_START msg=audit(1400253785.921:9): user pid=1517 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400253785.921:10): user pid=1517 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_LOGIN msg=audit(1400253785.923:11): user pid=1517 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_DISP msg=audit(1400253849.258:12): user pid=1517 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_END msg=audit(1400253849.262:13): user pid=1517 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_AUTH msg=audit(1400253857.813:14): user pid=1635 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1400253857.815:15): user pid=1635 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=LOGIN msg=audit(1400253857.815:16): pid=1635 uid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_ROLE_CHANGE msg=audit(1400253857.901:17): user pid=1635 uid=0 auid=0 ses=2 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_START msg=audit(1400253857.917:18): user pid=1635 uid=0 auid=0 ses=2 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400253857.917:19): user pid=1635 uid=0 auid=0 ses=2 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_LOGIN msg=audit(1400253857.917:20): user pid=1635 uid=0 auid=0 ses=2 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400253869.687:21): user pid=1663 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=1663 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400253869.687:22): user pid=1663 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=1663 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1400253869.690:23): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1663 suid=74 rport=57500 laddr=192.168.200.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1400253869.690:24): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1663 suid=74 rport=57500 laddr=192.168.200.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=USER_AUTH msg=audit(1400253871.026:25): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1400253872.722:26): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1400253872.725:27): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1400253872.726:28): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1663 suid=74 rport=57500 laddr=192.168.200.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=USER_AUTH msg=audit(1400253872.726:29): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1400253872.727:30): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=LOGIN msg=audit(1400253872.727:31): pid=1662 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_ROLE_CHANGE msg=audit(1400253872.858:32): user pid=1662 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_START msg=audit(1400253872.863:33): user pid=1662 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1400253872.868:34): user pid=1666 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400253872.868:35): user pid=1666 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400253872.869:36): user pid=1666 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=1666 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400253872.869:37): user pid=1666 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=1666 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=pts/0 res=success'
>type=CRED_REFR msg=audit(1400253872.870:38): user pid=1666 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_CMD msg=audit(1400253933.458:39): user pid=1689 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D20636C65616E20616C6C terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400253933.458:40): user pid=1689 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400253933.461:41): user pid=1689 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400253934.286:42): user pid=1689 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400253934.289:43): user pid=1689 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1400253941.386:44): user pid=1695 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D20757064617465 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400253941.387:45): user pid=1695 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400253941.387:46): user pid=1695 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400253960.446:47): user pid=1695 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400253960.446:48): user pid=1695 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1400253990.590:49): user pid=1700 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D20757064617465 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400253990.590:50): user pid=1700 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400253990.591:51): user pid=1700 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400253990.881:52): user pid=1700 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400253990.881:53): user pid=1700 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_ACCT msg=audit(1400254201.703:54): user pid=1708 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1400254201.703:55): user pid=1708 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1400254201.722:56): pid=1708 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1400254201.725:57): user pid=1708 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1400254201.856:58): user pid=1708 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1400254201.856:59): user pid=1708 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_CMD msg=audit(1400254226.359:60): user pid=1716 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D20636C65616E20616C6C terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400254226.359:61): user pid=1716 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400254226.360:62): user pid=1716 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400254226.586:63): user pid=1716 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400254226.586:64): user pid=1716 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1400254332.534:65): user pid=1728 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D2073656172636820646973636F76657279 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400254332.535:66): user pid=1728 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400254332.535:67): user pid=1728 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400254418.532:68): user pid=1728 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400254418.532:69): user pid=1728 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1400254443.276:70): user pid=1733 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D20696E7374616C6C202D7920666F72656D616E2D646973636F766572792D696D616765 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400254443.277:71): user pid=1733 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400254443.277:72): user pid=1733 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_ACCT msg=audit(1400254801.868:73): user pid=1745 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1400254801.869:74): user pid=1745 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1400254801.869:75): pid=1745 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1400254801.869:76): user pid=1745 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1400254801.912:77): user pid=1745 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1400254801.912:78): user pid=1745 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1400255402.423:79): user pid=1808 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1400255402.423:80): user pid=1808 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1400255402.426:81): pid=1808 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_START msg=audit(1400255402.545:82): user pid=1808 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1400255405.139:83): user pid=1808 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1400255405.139:84): user pid=1808 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1400255417.764:85): user pid=1733 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400255417.765:86): user pid=1733 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400255960.443:87): user pid=1359 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=1359 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400255960.443:88): user pid=1359 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=1359 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1400256002.275:89): user pid=1921 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1400256002.323:90): user pid=1921 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1400256002.336:91): pid=1921 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_START msg=audit(1400256002.411:92): user pid=1921 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1400256002.723:93): user pid=1921 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1400256002.723:94): user pid=1921 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1400256061.874:95): user pid=2023 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1400256061.875:96): user pid=2023 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1400256061.878:97): pid=2023 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
>type=USER_START msg=audit(1400256061.930:98): user pid=2023 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1400256062.583:99): user pid=2023 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1400256062.583:100): user pid=2023 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=ADD_USER msg=audit(1400256075.970:101): user pid=2100 uid=0 auid=0 ses=3 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="postfix" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
>type=ADD_USER msg=audit(1400256075.970:102): user pid=2100 uid=0 auid=0 ses=3 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="postfix" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
>type=MAC_POLICY_LOAD msg=audit(1400256102.296:103): policy loaded auid=0 ses=3
>type=SYSCALL msg=audit(1400256102.296:103): arch=c000003e syscall=1 success=yes exit=7292905 a0=4 a1=7f8955a62000 a2=6f47e9 a3=7fff2a3f7590 items=0 ppid=2540 pid=2545 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=3 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=USER_CMD msg=audit(1400256280.101:104): user pid=12011 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=73687574646F776E202D68206E6F77 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400256280.102:105): user pid=12011 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400256280.105:106): user pid=12011 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=SYSTEM_RUNLEVEL msg=audit(1400256280.133:107): user pid=12012 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0 exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
>type=SYSTEM_SHUTDOWN msg=audit(1400256280.133:108): user pid=12012 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_END msg=audit(1400256280.154:109): user pid=12011 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400256280.154:110): user pid=12011 uid=0 auid=0 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400256280.229:111): user pid=1635 uid=0 auid=0 ses=2 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe=2F62696E2F6C6F67696E202864656C6574656429 hostname=? addr=? terminal=tty1 res=success'
>type=USER_END msg=audit(1400256280.297:112): user pid=1635 uid=0 auid=0 ses=2 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe=2F62696E2F6C6F67696E202864656C6574656429 hostname=? addr=? terminal=tty1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400256281.264:113): user pid=1879 uid=0 auid=0 ses=3 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=1879 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400256281.264:114): user pid=1879 uid=0 auid=0 ses=3 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=1879 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1400256281.403:115): user pid=1662 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1400256281.404:116): user pid=1662 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_END msg=audit(1400256281.410:117): user pid=1662 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_LOGOUT msg=audit(1400256281.410:118): user pid=1662 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400256281.410:119): user pid=1662 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=1662 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400256281.414:120): user pid=1662 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=1662 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400256281.415:121): user pid=1662 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1662 suid=0 rport=57500 laddr=192.168.200.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=DAEMON_END msg=audit(1400256285.236:8810): auditd normal halt, sending auid=0 pid=12183 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1400256514.519:4916): auditd start, ver=2.2 format=raw kernel=2.6.32-431.17.1.el6.x86_64 auid=4294967295 pid=936 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1400256514.638:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1400256548.374:5): user pid=1375 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1400256548.376:6): user pid=1375 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=LOGIN msg=audit(1400256548.377:7): pid=1375 uid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1400256548.498:8): user pid=1375 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_START msg=audit(1400256548.572:9): user pid=1375 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400256548.573:10): user pid=1375 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_LOGIN msg=audit(1400256548.574:11): user pid=1375 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_CMD msg=audit(1400256564.560:12): user pid=1482 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=79756D20696E7374616C6C20666F72656D616E2D696E7374616C6C65722D7374617970756674 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400256564.561:13): user pid=1482 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1400256564.565:14): user pid=1482 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_END msg=audit(1400256571.293:15): user pid=1482 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400256571.293:16): user pid=1482 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_ACCT msg=audit(1400256601.903:17): user pid=1505 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1400256601.903:18): user pid=1505 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1400256601.911:19): pid=1505 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1400256601.913:20): user pid=1505 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1400256602.029:21): user pid=1505 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1400256602.029:22): user pid=1505 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=DAEMON_START msg=audit(1400256737.754:1293): auditd start, ver=2.2 format=raw kernel=2.6.32-431.17.1.el6.x86_64 auid=4294967295 pid=1129 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1400256737.866:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1400256746.136:5): user pid=1565 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1400256746.139:6): user pid=1565 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=LOGIN msg=audit(1400256746.141:7): pid=1565 uid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1400256746.257:8): user pid=1565 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_START msg=audit(1400256746.326:9): user pid=1565 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400256746.328:10): user pid=1565 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_LOGIN msg=audit(1400256746.329:11): user pid=1565 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_CMD msg=audit(1400256757.366:12): user pid=1672 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=79756D20696E7374616C6C20666F72656D616E2D696E7374616C6C65722D7374617970756674 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400256757.367:13): user pid=1672 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1400256757.369:14): user pid=1672 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=ADD_GROUP msg=audit(1400257004.389:15): user pid=1688 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=498 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257004.459:16): user pid=1688 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=498 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257004.459:17): user pid=1688 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=498 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1400257004.570:18): user pid=1693 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=498 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=USER_AUTH msg=audit(1400257010.803:19): user pid=1704 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1400257010.803:20): user pid=1704 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1400257010.809:21): user pid=1704 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1400257010.809:22): user pid=1704 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1400257013.462:23): user pid=1704 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1400257013.462:24): user pid=1704 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_AUTH msg=audit(1400257013.472:25): user pid=1734 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1400257013.473:26): user pid=1734 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1400257013.473:27): user pid=1734 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1400257013.473:28): user pid=1734 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1400257016.086:29): user pid=1734 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1400257016.087:30): user pid=1734 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257043.845:31): user pid=1776 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=27 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257043.945:32): user pid=1776 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=27 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257043.945:33): user pid=1776 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=27 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1400257044.040:34): user pid=1780 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=27 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257047.300:35): user pid=1791 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=52 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257047.391:36): user pid=1791 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=52 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257047.391:37): user pid=1791 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=52 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1400257047.505:38): user pid=1796 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=52 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=USER_AUTH msg=audit(1400257059.722:39): user pid=1806 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1400257059.723:40): user pid=1806 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1400257059.727:41): user pid=1806 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1400257059.727:42): user pid=1806 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1400257062.916:43): user pid=1806 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1400257062.916:44): user pid=1806 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_AUTH msg=audit(1400257062.943:45): user pid=1832 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1400257062.943:46): user pid=1832 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1400257062.944:47): user pid=1832 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1400257062.944:48): user pid=1832 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1400257066.035:49): user pid=1832 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1400257066.036:50): user pid=1832 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_AUTH msg=audit(1400257066.050:51): user pid=1858 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1400257066.050:52): user pid=1858 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1400257066.050:53): user pid=1858 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1400257066.050:54): user pid=1858 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1400257069.269:55): user pid=1858 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1400257069.270:56): user pid=1858 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:rpm_script_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/bin/su" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1400257081.405:57): user pid=1672 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400257081.406:58): user pid=1672 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_CMD msg=audit(1400257127.367:59): user pid=1893 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=73687574646F776E202D68206E6F77 terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400257127.367:60): user pid=1893 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=USER_START msg=audit(1400257127.371:61): user pid=1893 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=SYSTEM_RUNLEVEL msg=audit(1400257127.392:62): user pid=1894 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0 exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
>type=SYSTEM_SHUTDOWN msg=audit(1400257127.392:63): user pid=1894 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
>type=USER_END msg=audit(1400257127.416:64): user pid=1893 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400257127.416:65): user pid=1893 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/tty1 res=success'
>type=CRED_DISP msg=audit(1400257127.430:66): user pid=1565 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_END msg=audit(1400257127.441:67): user pid=1565 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257128.493:68): user pid=1407 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=1407 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257128.493:69): user pid=1407 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=1407 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=DAEMON_END msg=audit(1400257132.556:1294): auditd normal halt, sending auid=0 pid=2073 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1400257237.758:6790): auditd start, ver=2.2 format=raw kernel=2.6.32-431.17.1.el6.x86_64 auid=4294967295 pid=1081 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1400257237.885:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_AUTH msg=audit(1400257256.485:5): user pid=1517 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_ACCT msg=audit(1400257256.487:6): user pid=1517 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=LOGIN msg=audit(1400257256.487:7): pid=1517 uid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1400257256.585:8): user pid=1517 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_START msg=audit(1400257256.655:9): user pid=1517 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRED_ACQ msg=audit(1400257256.658:10): user pid=1517 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=USER_LOGIN msg=audit(1400257256.659:11): user pid=1517 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257310.782:12): user pid=1626 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=1626 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257310.782:13): user pid=1626 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=1626 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1400257310.785:14): user pid=1625 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1626 suid=74 rport=57738 laddr=192.168.200.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1400257310.785:15): user pid=1625 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1626 suid=74 rport=57738 laddr=192.168.200.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=USER_AUTH msg=audit(1400257311.071:16): user pid=1625 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1400257313.211:17): user pid=1625 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1400257313.218:18): user pid=1625 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257313.222:19): user pid=1625 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1626 suid=74 rport=57738 laddr=192.168.200.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=USER_AUTH msg=audit(1400257313.223:20): user pid=1625 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1400257313.223:21): user pid=1625 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=LOGIN msg=audit(1400257313.223:22): pid=1625 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_ROLE_CHANGE msg=audit(1400257313.383:23): user pid=1625 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_START msg=audit(1400257313.387:24): user pid=1625 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1400257313.393:25): user pid=1629 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400257313.393:26): user pid=1629 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257313.393:27): user pid=1629 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=1629 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257313.393:28): user pid=1629 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=1629 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=pts/0 res=success'
>type=CRED_REFR msg=audit(1400257313.394:29): user pid=1629 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_CMD msg=audit(1400257326.516:30): user pid=1647 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=79756D20696E7374616C6C20666F72656D616E2D73656C696E75782D312E352E302D302E322E5243322E656C362E6E6F617263682E72706D terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400257326.516:31): user pid=1647 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400257326.519:32): user pid=1647 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=MAC_CONFIG_CHANGE msg=audit(1400257404.854:33): bool=httpd_setrlimit val=1 old_val=0 auid=0 ses=2
>type=SYSCALL msg=audit(1400257404.854:33): arch=c000003e syscall=1 success=yes exit=2 a0=7 a1=7fffa7012fa0 a2=2 a3=0 items=0 ppid=1664 pid=1666 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="semanage" exe="/usr/bin/python" subj=unconfined_u:system_r:semanage_t:s0-s0:c0.c1023 key=(null)
>type=MAC_POLICY_LOAD msg=audit(1400257405.066:34): policy loaded auid=0 ses=2
>type=SYSCALL msg=audit(1400257405.066:34): arch=c000003e syscall=1 success=yes exit=7318910 a0=4 a1=7fb4204c6000 a2=6fad7e a3=7fff0d0c5440 items=0 ppid=1666 pid=1667 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1400257410.890:35): user pid=1647 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400257410.891:36): user pid=1647 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=ANOM_ABEND msg=audit(1400257482.448:37): auid=0 uid=0 gid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=2783 comm="puppet" sig=6
>type=USER_AUTH msg=audit(1400257490.378:38): user pid=3542 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1400257490.378:39): user pid=3542 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_START msg=audit(1400257490.383:40): user pid=3542 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400257490.383:41): user pid=3542 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_DISP msg=audit(1400257493.822:42): user pid=3542 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_END msg=audit(1400257493.823:43): user pid=3542 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=MAC_STATUS msg=audit(1400257514.867:44): enforcing=0 old_enforcing=1 auid=0 ses=2
>type=SYSCALL msg=audit(1400257514.867:44): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fffa079f620 a2=1 a3=7fffa079e3a0 items=0 ppid=1629 pid=3571 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=ANOM_ABEND msg=audit(1400257537.769:45): auid=0 uid=0 gid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 pid=4120 comm="puppet" sig=6
>type=USER_AUTH msg=audit(1400257544.331:46): user pid=4879 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1400257544.332:47): user pid=4879 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_START msg=audit(1400257544.332:48): user pid=4879 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400257544.332:49): user pid=4879 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_DISP msg=audit(1400257546.927:50): user pid=4879 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_END msg=audit(1400257546.927:51): user pid=4879 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_CMD msg=audit(1400257586.068:52): user pid=4906 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/root" cmd=79756D20757064617465 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400257586.069:53): user pid=4906 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400257586.069:54): user pid=4906 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400257586.760:55): user pid=4906 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400257586.760:56): user pid=4906 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1400257599.977:57): user pid=4909 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D20636C65616E terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400257599.979:58): user pid=4909 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400257599.979:59): user pid=4909 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400257600.167:60): user pid=4909 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400257600.167:61): user pid=4909 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1400257604.704:62): user pid=4911 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D20636C65616E20616C6C terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400257604.704:63): user pid=4911 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400257604.704:64): user pid=4911 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400257604.942:65): user pid=4911 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400257604.942:66): user pid=4911 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1400257608.181:67): user pid=4913 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D20757064617465 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400257608.182:68): user pid=4913 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400257608.182:69): user pid=4913 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400257641.099:70): user pid=4913 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400257641.099:71): user pid=4913 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1400257669.261:72): user pid=4921 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D2072656D6F766520666F72656D616E2D696E7374616C6C2D7374617970756674 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400257669.261:73): user pid=4921 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400257669.262:74): user pid=4921 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400257669.909:75): user pid=4921 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400257669.909:76): user pid=4921 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1400257673.287:77): user pid=4923 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D2072656D6F766520666F72656D616E2D696E7374616C6C65722D7374617970756674 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400257673.287:78): user pid=4923 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400257673.288:79): user pid=4923 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400257679.679:80): user pid=4923 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400257679.680:81): user pid=4923 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_CMD msg=audit(1400257684.978:82): user pid=4925 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='cwd="/etc/yum.repos.d" cmd=79756D20696E7374616C6C20666F72656D616E2D696E7374616C6C65722D7374617970756674 terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400257684.980:83): user pid=4925 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1400257684.980:84): user pid=4925 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1400257689.860:85): user pid=4925 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRED_DISP msg=audit(1400257689.860:86): user pid=4925 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=ADD_GROUP msg=audit(1400257779.470:87): user pid=6693 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=25 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257779.579:88): user pid=6693 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=25 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257779.579:89): user pid=6693 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=25 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1400257779.714:90): user pid=6697 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=25 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257797.859:91): user pid=6725 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=26 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257797.920:92): user pid=6725 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=26 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257797.922:93): user pid=6725 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=26 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1400257798.003:94): user pid=6729 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=26 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1400257801.130:95): user pid=6737 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1400257801.130:96): user pid=6737 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1400257801.136:97): user pid=6738 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1400257801.136:98): user pid=6738 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1400257801.139:99): pid=6738 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=LOGIN msg=audit(1400257801.142:100): pid=6737 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=498 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1400257801.148:101): user pid=6737 uid=0 auid=498 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1400257801.152:102): user pid=6738 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1400257801.339:103): user pid=6738 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1400257801.339:104): user pid=6738 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1400257809.519:105): user pid=6737 uid=498 auid=498 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1400257809.519:106): user pid=6737 uid=498 auid=498 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=ADD_GROUP msg=audit(1400257829.452:107): user pid=6766 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=497 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257829.545:108): user pid=6766 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=497 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257829.545:109): user pid=6766 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=497 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1400257829.635:110): user pid=6771 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=497 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257836.941:111): user pid=6789 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=177 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257837.003:112): user pid=6789 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=177 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257837.003:113): user pid=6789 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=177 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1400257837.077:114): user pid=6794 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=177 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257862.473:115): user pid=6907 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=6907 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257862.473:116): user pid=6907 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=6907 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1400257862.480:117): user pid=6906 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=6907 suid=74 rport=57761 laddr=192.168.200.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1400257862.480:118): user pid=6906 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=6907 suid=74 rport=57761 laddr=192.168.200.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=USER_AUTH msg=audit(1400257862.731:119): user pid=6906 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1400257864.578:120): user pid=6906 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1400257864.580:121): user pid=6906 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257864.581:122): user pid=6906 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=6907 suid=74 rport=57761 laddr=192.168.200.16 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=? res=success'
>type=USER_AUTH msg=audit(1400257864.582:123): user pid=6906 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1400257864.583:124): user pid=6906 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=LOGIN msg=audit(1400257864.583:125): pid=6906 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_ROLE_CHANGE msg=audit(1400257864.756:126): user pid=6906 uid=0 auid=0 ses=5 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_START msg=audit(1400257864.761:127): user pid=6906 uid=0 auid=0 ses=5 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1400257864.767:128): user pid=6915 uid=0 auid=0 ses=5 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=/dev/pts/2 res=success'
>type=USER_START msg=audit(1400257864.767:129): user pid=6915 uid=0 auid=0 ses=5 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=/dev/pts/2 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257864.768:130): user pid=6915 uid=0 auid=0 ses=5 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=76:03:c2:6e:6c:d1:76:66:28:0b:c3:ee:86:03:96:e8 direction=? spid=6915 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=pts/2 res=success'
>type=CRYPTO_KEY_USER msg=audit(1400257864.768:131): user pid=6915 uid=0 auid=0 ses=5 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4e:ab:85:31:83:b7:ed:ef:af:e1:7d:a2:c3:5e:ad:74 direction=? spid=6915 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.200.1 terminal=pts/2 res=success'
>type=CRED_REFR msg=audit(1400257864.773:132): user pid=6915 uid=0 auid=0 ses=5 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.200.1 addr=192.168.200.1 terminal=ssh res=success'
>type=ADD_GROUP msg=audit(1400257864.820:133): user pid=6914 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=48 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257864.879:134): user pid=6914 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=48 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1400257864.879:135): user pid=6914 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=48 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1400257865.009:136): user pid=6936 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=48 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1400257906.236:137): user pid=7711 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="postgres" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1400257906.237:138): user pid=7711 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="postgres" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1400257906.325:139): user pid=7711 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="postgres" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1400257906.326:140): user pid=7711 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="postgres" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1400257907.285:141): user pid=7770 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="postgres" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1400257907.285:142): user pid=7770 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="postgres" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1400257907.314:143): user pid=7770 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="postgres" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1400257907.314:144): user pid=7770 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="postgres" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1400257936.601:145): user pid=8003 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1400257936.602:146): user pid=8003 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
>type=USER_CHAUTHTOK msg=audit(1400257937.001:147): user pid=8014 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=changing user shell id=498 exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1400257937.120:148): user pid=8021 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=adding user to group acct="foreman" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1400257937.121:149): user pid=8021 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=adding user to shadow group acct="foreman" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1400258008.226:150): user pid=8153 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1400258008.226:151): user pid=8153 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1400258023.101:152): user pid=8153 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1400258023.101:153): user pid=8153 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="foreman" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1400258028.227:154): user pid=8393 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=changing comment id=497 exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1400258028.394:155): user pid=8400 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=changing user shell id=497 exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1400258028.544:156): user pid=8407 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=adding user to group acct="foreman-proxy" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1400258028.545:157): user pid=8407 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=adding user to group acct="foreman-proxy" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1400258028.545:158): user pid=8407 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=adding user to shadow group acct="foreman-proxy" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1400258028.545:159): user pid=8407 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=adding user to shadow group acct="foreman-proxy" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1400258031.503:160): user pid=8558 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="foreman-proxy" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1400258031.507:161): user pid=8558 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="foreman-proxy" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1400258032.724:162): user pid=8558 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="foreman-proxy" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1400258032.724:163): user pid=8558 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="foreman-proxy" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1400258033.035:164): avc:  denied  { relabelto } for  pid=8510 comm="ruby" name="yaml" dev=dm-0 ino=537367 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1400258033.035:164): arch=c000003e syscall=189 success=yes exit=0 a0=335cd90 a1=7f906eed6319 a2=229cdf0 a3=26 items=0 ppid=8340 pid=8510 auid=0 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1400258033.076:165): avc:  denied  { relabelto } for  pid=8510 comm="ruby" name="masterhttp.log" dev=dm-0 ino=536269 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:puppet_log_t:s0 tclass=file
>type=SYSCALL msg=audit(1400258033.076:165): arch=c000003e syscall=189 success=yes exit=0 a0=2954b00 a1=7f906eed6319 a2=3f93010 a3=22 items=0 ppid=8340 pid=8510 auid=0 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1400258033.337:166): avc:  denied  { relabelto } for  pid=8510 comm="ruby" name="ca_crt.pem" dev=dm-0 ino=536250 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:puppet_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1400258033.337:166): arch=c000003e syscall=189 success=yes exit=0 a0=45278a0 a1=7f906eed6319 a2=4622a90 a3=26 items=0 ppid=8340 pid=8510 auid=0 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=2 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1400258050.395:167): avc:  denied  { write } for  pid=8914 comm="ruby" name="dynflow_socket" dev=dm-0 ino=282452 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=unconfined_u:object_r:foreman_var_run_t:s0 tclass=sock_file
>type=AVC msg=audit(1400258050.395:167): avc:  denied  { connectto } for  pid=8914 comm="ruby" path="/var/run/foreman/sockets/dynflow_socket" scontext=unconfined_u:system_r:passenger_t:s0 tcontext=unconfined_u:system_r:initrc_t:s0 tclass=unix_stream_socket
>type=SYSCALL msg=audit(1400258050.395:167): arch=c000003e syscall=42 success=yes exit=0 a0=9 a1=7fb016e3d820 a2=6e a3=7fb016e3d1c0 items=0 ppid=8637 pid=8914 auid=0 uid=498 gid=498 euid=498 suid=498 fsuid=498 egid=498 sgid=498 fsgid=498 tty=(none) ses=2 comm="ruby" exe="/opt/rh/ruby193/root/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=USER_AUTH msg=audit(1400258070.004:168): user pid=9309 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1400258070.006:169): user pid=9309 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_START msg=audit(1400258070.023:170): user pid=9309 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1400258070.023:171): user pid=9309 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_DISP msg=audit(1400258271.558:172): user pid=9309 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_END msg=audit(1400258271.560:173): user pid=9309 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="foreman" exe="/bin/su" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_ACCT msg=audit(1400258401.610:174): user pid=9767 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1400258401.612:175): user pid=9767 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1400258401.637:176): pid=9767 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_START msg=audit(1400258401.661:177): user pid=9767 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1400258401.752:178): user pid=9767 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1400258401.753:179): user pid=9767 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>

Actions: View

Attachments on bug 1098244: 895963 | 896468 | 896469 | 898390 | 899508 | 899509