Attachment 907714 Details for Bug 1108036 – audit.log

audit.log

audit.log (text/x-log), 19.79 KB, created by Ofer Blaut on 2014-06-11 15:53:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ofer Blaut

Created: 2014-06-11 15:53:11 UTC

Size: 19.79 KB

patch

obsolete

>type=DAEMON_START msg=audit(1402501304.402:9451): auditd start, ver=2.2 format=raw kernel=2.6.32-431.el6.x86_64 auid=0 pid=26455 subj=unconfined_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1402501304.513:70): audit_backlog_limit=320 old=64 auid=0 ses=91 subj=unconfined_u:system_r:auditctl_t:s0 res=1
>type=AVC msg=audit(1402501336.395:71): avc:  denied  { execute } for  pid=26484 comm="ruby" name="node.rb" dev=dm-0 ino=1836556 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=file
>type=AVC msg=audit(1402501336.395:71): avc:  denied  { execute_no_trans } for  pid=26484 comm="ruby" path="/etc/puppet/node.rb" dev=dm-0 ino=1836556 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=file
>type=SYSCALL msg=audit(1402501336.395:71): arch=c000003e syscall=59 success=yes exit=0 a0=815f300 a1=7fff39718510 a2=8c6b0d0 a3=8 items=0 ppid=25157 pid=26484 auid=0 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=7 comm="node.rb" exe="/bin/env" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1402501343.415:72): avc:  denied  { execute } for  pid=26722 comm="ruby" name="node.rb" dev=dm-0 ino=1836556 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=file
>type=AVC msg=audit(1402501343.415:72): avc:  denied  { execute_no_trans } for  pid=26722 comm="ruby" path="/etc/puppet/node.rb" dev=dm-0 ino=1836556 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:puppet_etc_t:s0 tclass=file
>type=SYSCALL msg=audit(1402501343.415:72): arch=c000003e syscall=59 success=yes exit=0 a0=8295900 a1=7fff3970c040 a2=8e4f350 a3=8 items=0 ppid=25157 pid=26722 auid=0 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=7 comm="node.rb" exe="/bin/env" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1402501347.083:73): avc:  denied  { getattr } for  pid=26633 comm="ruby" path="/sbin/iptables-multi-1.4.7" dev=dm-0 ino=28181312 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1402501347.083:73): arch=c000003e syscall=4 success=yes exit=0 a0=6f1b460 a1=7fffe7acf1a0 a2=7fffe7acf1a0 a3=6f1b4f0 items=0 ppid=26480 pid=26633 auid=0 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=7 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1402501347.083:74): avc:  denied  { execute } for  pid=26633 comm="ruby" name="iptables-multi-1.4.7" dev=dm-0 ino=28181312 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1402501347.083:74): arch=c000003e syscall=21 success=yes exit=0 a0=6f1b460 a1=1 a2=0 a3=6f1b4f0 items=0 ppid=26480 pid=26633 auid=0 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=7 comm="ruby" exe="/usr/bin/ruby" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=AVC msg=audit(1402501347.087:75): avc:  denied  { read open } for  pid=26997 comm="ruby" name="iptables-multi-1.4.7" dev=dm-0 ino=28181312 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file
>type=AVC msg=audit(1402501347.087:75): avc:  denied  { execute_no_trans } for  pid=26997 comm="ruby" path="/sbin/iptables-multi-1.4.7" dev=dm-0 ino=28181312 scontext=unconfined_u:system_r:passenger_t:s0 tcontext=system_u:object_r:iptables_exec_t:s0 tclass=file
>type=SYSCALL msg=audit(1402501347.087:75): arch=c000003e syscall=59 success=yes exit=0 a0=7fffe7ad4520 a1=7fffe7ad4550 a2=5272850 a3=fffffffffffffff0 items=0 ppid=26633 pid=26997 auid=0 uid=52 gid=52 euid=52 suid=52 fsuid=52 egid=52 sgid=52 fsgid=52 tty=(none) ses=7 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:passenger_t:s0 key=(null)
>type=SYSTEM_RUNLEVEL msg=audit(1402501347.440:76): user pid=27005 uid=0 auid=0 ses=91 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=6 exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
>type=SYSTEM_SHUTDOWN msg=audit(1402501347.441:77): user pid=27005 uid=0 auid=0 ses=91 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501348.141:78): user pid=6156 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bb:de:e9:24:6f:b2:eb:d8:05:b7:f0:a3:70:53:51:49 direction=? spid=6156 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501348.141:79): user pid=6156 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:c0:bb:98:9b:ab:bf:11:aa:d1:21:7e:7d:16:cf:10 direction=? spid=6156 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1402501348.251:80): user pid=26154 uid=0 auid=0 ses=91 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1402501348.252:81): user pid=26154 uid=0 auid=0 ses=91 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=USER_END msg=audit(1402501348.253:82): user pid=26154 uid=0 auid=0 ses=91 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_LOGOUT msg=audit(1402501348.253:83): user pid=26154 uid=0 auid=0 ses=91 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501348.253:84): user pid=26154 uid=0 auid=0 ses=91 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bb:de:e9:24:6f:b2:eb:d8:05:b7:f0:a3:70:53:51:49 direction=? spid=26154 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501348.254:85): user pid=26154 uid=0 auid=0 ses=91 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:c0:bb:98:9b:ab:bf:11:aa:d1:21:7e:7d:16:cf:10 direction=? spid=26154 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501348.254:86): user pid=26154 uid=0 auid=0 ses=91 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26154 suid=0 rport=35889 laddr=10.35.160.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=DAEMON_END msg=audit(1402501357.051:9452): auditd normal halt, sending auid=0 pid=27205 subj=system_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1402501558.429:1657): auditd start, ver=2.2 format=raw kernel=2.6.32-431.17.1.el6.x86_64 auid=4294967295 pid=1435 subj=system_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1402501558.561:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
>type=USER_START msg=audit(1402501575.045:5): user pid=6345 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="foreman-proxy" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_ACQ msg=audit(1402501575.045:6): user pid=6345 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="foreman-proxy" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRED_DISP msg=audit(1402501576.954:7): user pid=6345 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="foreman-proxy" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=USER_END msg=audit(1402501576.954:8): user pid=6345 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="foreman-proxy" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501763.760:9): user pid=6481 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bb:de:e9:24:6f:b2:eb:d8:05:b7:f0:a3:70:53:51:49 direction=? spid=6481 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501763.761:10): user pid=6481 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:c0:bb:98:9b:ab:bf:11:aa:d1:21:7e:7d:16:cf:10 direction=? spid=6481 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1402501763.832:11): user pid=6480 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=6481 suid=74 rport=36084 laddr=10.35.160.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1402501763.832:12): user pid=6480 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=6481 suid=74 rport=36084 laddr=10.35.160.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=USER_AUTH msg=audit(1402501767.620:13): user pid=6480 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=36084 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=USER_AUTH msg=audit(1402501767.621:14): user pid=6480 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=2d:5b:f2:72:4d:c3:8c:98:0d:c0:3c:9e:cb:4a:c3:dc rport=36084 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=USER_ACCT msg=audit(1402501767.761:15): user pid=6480 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501767.761:16): user pid=6480 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=6481 suid=74 rport=36084 laddr=10.35.160.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=USER_AUTH msg=audit(1402501767.762:17): user pid=6480 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1402501767.769:18): user pid=6480 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=LOGIN msg=audit(1402501767.769:19): pid=6480 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_ROLE_CHANGE msg=audit(1402501767.876:20): user pid=6480 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=USER_START msg=audit(1402501767.881:21): user pid=6480 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1402501767.991:22): user pid=6483 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1402501767.992:23): user pid=6483 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501768.015:24): user pid=6483 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bb:de:e9:24:6f:b2:eb:d8:05:b7:f0:a3:70:53:51:49 direction=? spid=6483 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501768.015:25): user pid=6483 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:c0:bb:98:9b:ab:bf:11:aa:d1:21:7e:7d:16:cf:10 direction=? spid=6483 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=pts/0 res=success'
>type=CRED_REFR msg=audit(1402501768.016:26): user pid=6483 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501799.381:27): user pid=6498 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bb:de:e9:24:6f:b2:eb:d8:05:b7:f0:a3:70:53:51:49 direction=? spid=6498 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501799.381:28): user pid=6498 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:c0:bb:98:9b:ab:bf:11:aa:d1:21:7e:7d:16:cf:10 direction=? spid=6498 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1402501799.454:29): user pid=6497 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=6498 suid=74 rport=36085 laddr=10.35.160.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1402501799.454:30): user pid=6497 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=6498 suid=74 rport=36085 laddr=10.35.160.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=USER_ACCT msg=audit(1402501801.159:31): user pid=6499 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1402501801.159:32): user pid=6499 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1402501801.166:33): pid=6499 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1402501801.176:34): user pid=6499 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1402501801.286:35): user pid=6499 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1402501801.286:36): user pid=6499 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_AUTH msg=audit(1402501802.393:37): user pid=6497 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=36085 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=USER_AUTH msg=audit(1402501802.393:38): user pid=6497 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=2d:5b:f2:72:4d:c3:8c:98:0d:c0:3c:9e:cb:4a:c3:dc rport=36085 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=USER_ACCT msg=audit(1402501802.398:39): user pid=6497 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501802.398:40): user pid=6497 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=6498 suid=74 rport=36085 laddr=10.35.160.75 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=USER_AUTH msg=audit(1402501802.399:41): user pid=6497 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1402501802.400:42): user pid=6497 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=LOGIN msg=audit(1402501802.400:43): pid=6497 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_ROLE_CHANGE msg=audit(1402501802.494:44): user pid=6497 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=USER_START msg=audit(1402501802.497:45): user pid=6497 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1402501802.560:46): user pid=6497 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=USER_START msg=audit(1402501802.560:47): user pid=6497 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501802.561:48): user pid=6503 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=bb:de:e9:24:6f:b2:eb:d8:05:b7:f0:a3:70:53:51:49 direction=? spid=6503 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1402501802.561:49): user pid=6503 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:c0:bb:98:9b:ab:bf:11:aa:d1:21:7e:7d:16:cf:10 direction=? spid=6503 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.35.202.107 terminal=? res=success'
>type=CRED_REFR msg=audit(1402501802.562:50): user pid=6503 uid=0 auid=0 ses=3 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-202-107.tlv.redhat.com addr=10.35.202.107 terminal=ssh res=success'

Actions: View

Attachments on bug 1108036: 907574 | 907714