Attachment 910882 Details for Bug 1105344 – audit.log with AVC messages.

audit.log with AVC messages.

audit.log (text/plain), 43.77 KB, created by Alexander Chuzhoy on 2014-06-20 20:06:21 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Alexander Chuzhoy

Created: 2014-06-20 20:06:21 UTC

Size: 43.77 KB

patch

obsolete

>type=DAEMON_START msg=audit(1403292957.957:6209): auditd start, ver=2.3.3 format=raw kernel=3.10.0-121.el7.x86_64 auid=4294967295 pid=11493 subj=system_u:system_r:auditd_t:s0 res=success
>type=SERVICE_START msg=audit(1403292957.999:26): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="auditd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403292958.264:27): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="firewalld" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403292958.264:28): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="firewalld" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1403292962.103:29): pid=11568 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:useradd_t:s0 msg='op=adding group acct="apache" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1403292962.112:30): pid=11568 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:useradd_t:s0 msg='op=adding user id=48 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403292964.151:31): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403292974.204:32): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403292983.355:33): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="mariadb" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403292984.214:34): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="xinetd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1403293006.663:35): table=filter family=2 entries=0
>type=SYSCALL msg=audit(1403293006.663:35): arch=c000003e syscall=313 success=yes exit=0 a0=0 a1=7f897b9c6d89 a2=0 a3=0 items=0 ppid=12416 pid=12417 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/usr/bin/kmod" subj=system_u:system_r:insmod_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1403293006.664:36): table=filter family=2 entries=4
>type=SYSCALL msg=audit(1403293006.664:36): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1ee14c0 items=0 ppid=2666 pid=12410 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1403293006.901:37): table=filter family=2 entries=5
>type=SYSCALL msg=audit(1403293006.901:37): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2115b50 items=0 ppid=2666 pid=12450 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1403293007.170:38): table=filter family=2 entries=6
>type=SYSCALL msg=audit(1403293007.170:38): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=2660fb0 items=0 ppid=2666 pid=12483 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
>type=SERVICE_START msg=audit(1403293008.199:39): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="mariadb" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403293008.199:40): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="mariadb" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293012.703:41): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="mariadb" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293016.608:42): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-cinder-api" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293017.790:43): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="mongod" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293022.748:44): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="epmd@0.0.0.0" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293024.150:45): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="rabbitmq-server" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293184.678:46): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="xinetd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403293184.678:47): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="xinetd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293184.763:48): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="xinetd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1403293186.045:49): pid=13998 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:groupadd_t:s0 msg='op=adding group to /etc/group id=163 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1403293186.050:50): pid=13998 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:groupadd_t:s0 msg='op=adding group to /etc/gshadow id=163 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1403293186.052:51): pid=13998 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:groupadd_t:s0 msg='op= id=163 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1403293186.066:52): pid=14003 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:useradd_t:s0 msg='op=adding user id=163 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293190.521:53): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-cinder-volume" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293191.100:54): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-cinder-scheduler" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1403293191.738:55): pid=14510 uid=165 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E6620656E76204C435F414C4C3D4320766773202D2D6E6F68656164696E6773202D6F206E616D652063696E6465722D766F6C756D6573 terminal=? res=success'
>type=CRED_ACQ msg=audit(1403293191.743:56): pid=14510 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1403293191.745:57): pid=14510 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1403293191.871:58): pid=14510 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1403293191.871:59): pid=14510 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293198.155:60): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-swift-proxy" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1403293198.799:61): avc:  denied  { search } for  pid=14890 comm="swift-proxy-ser" name="httpd" dev="dm-0" ino=26196995 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=dir
>type=SYSCALL msg=audit(1403293198.799:61): arch=c000003e syscall=4 success=no exit=-13 a0=2341b50 a1=7fff2b4ac520 a2=7fff2b4ac520 a3=1 items=0 ppid=1 pid=14890 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm="swift-proxy-ser" exe="/usr/bin/python2.7" subj=system_u:system_r:swift_t:s0 key=(null)
>type=AVC msg=audit(1403293198.799:62): avc:  denied  { search } for  pid=14890 comm="swift-proxy-ser" name="httpd" dev="dm-0" ino=26196995 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=dir
>type=SYSCALL msg=audit(1403293198.799:62): arch=c000003e syscall=4 success=no exit=-13 a0=217dc80 a1=7fff2b4ac520 a2=7fff2b4ac520 a3=0 items=0 ppid=1 pid=14890 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm="swift-proxy-ser" exe="/usr/bin/python2.7" subj=system_u:system_r:swift_t:s0 key=(null)
>type=AVC msg=audit(1403293198.878:63): avc:  denied  { search } for  pid=14890 comm="swift-proxy-ser" name="httpd" dev="dm-0" ino=26196995 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=dir
>type=SYSCALL msg=audit(1403293198.878:63): arch=c000003e syscall=4 success=no exit=-13 a0=2689aa0 a1=7fff2b4ac120 a2=7fff2b4ac120 a3=0 items=0 ppid=1 pid=14890 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm="swift-proxy-ser" exe="/usr/bin/python2.7" subj=system_u:system_r:swift_t:s0 key=(null)
>type=AVC msg=audit(1403293198.878:64): avc:  denied  { search } for  pid=14890 comm="swift-proxy-ser" name="httpd" dev="dm-0" ino=26196995 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=dir
>type=SYSCALL msg=audit(1403293198.878:64): arch=c000003e syscall=4 success=no exit=-13 a0=202b1f0 a1=7fff2b4ac120 a2=7fff2b4ac120 a3=1 items=0 ppid=1 pid=14890 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm="swift-proxy-ser" exe="/usr/bin/python2.7" subj=system_u:system_r:swift_t:s0 key=(null)
>type=AVC msg=audit(1403293199.026:65): avc:  denied  { search } for  pid=14917 comm="swift-proxy-ser" name="httpd" dev="dm-0" ino=26196995 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=dir
>type=SYSCALL msg=audit(1403293199.026:65): arch=c000003e syscall=4 success=no exit=-13 a0=2504100 a1=7fff2b4ac320 a2=7fff2b4ac320 a3=0 items=0 ppid=14890 pid=14917 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm="swift-proxy-ser" exe="/usr/bin/python2.7" subj=system_u:system_r:swift_t:s0 key=(null)
>type=AVC msg=audit(1403293199.026:66): avc:  denied  { search } for  pid=14917 comm="swift-proxy-ser" name="httpd" dev="dm-0" ino=26196995 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=dir
>type=SYSCALL msg=audit(1403293199.026:66): arch=c000003e syscall=4 success=no exit=-13 a0=2429860 a1=7fff2b4ac320 a2=7fff2b4ac320 a3=0 items=0 ppid=14890 pid=14917 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm="swift-proxy-ser" exe="/usr/bin/python2.7" subj=system_u:system_r:swift_t:s0 key=(null)
>type=AVC msg=audit(1403293199.095:67): avc:  denied  { search } for  pid=14917 comm="swift-proxy-ser" name="httpd" dev="dm-0" ino=26196995 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=dir
>type=SYSCALL msg=audit(1403293199.095:67): arch=c000003e syscall=4 success=no exit=-13 a0=2036d10 a1=7fff2b4abf20 a2=7fff2b4abf20 a3=0 items=0 ppid=14890 pid=14917 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm="swift-proxy-ser" exe="/usr/bin/python2.7" subj=system_u:system_r:swift_t:s0 key=(null)
>type=AVC msg=audit(1403293199.095:68): avc:  denied  { search } for  pid=14917 comm="swift-proxy-ser" name="httpd" dev="dm-0" ino=26196995 scontext=system_u:system_r:swift_t:s0 tcontext=system_u:object_r:httpd_config_t:s0 tclass=dir
>type=SYSCALL msg=audit(1403293199.095:68): arch=c000003e syscall=4 success=no exit=-13 a0=27206e0 a1=7fff2b4abf20 a2=7fff2b4abf20 a3=0 items=0 ppid=14890 pid=14917 auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4294967295 comm="swift-proxy-ser" exe="/usr/bin/python2.7" subj=system_u:system_r:swift_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1403293200.548:69): table=filter family=2 entries=7
>type=SYSCALL msg=audit(1403293200.548:69): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1c77400 items=0 ppid=2666 pid=14938 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
>type=SERVICE_START msg=audit(1403293206.932:70): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-nova-novncproxy" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293207.383:71): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-nova-consoleauth" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293208.073:72): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-nova-api" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293209.070:73): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-nova-scheduler" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293211.501:74): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-nova-conductor" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1403293212.254:75): pid=15218 uid=162 auid=4294967295 ses=4294967295 subj=system_u:system_r:nova_api_t:s0 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1403293212.255:76): pid=15218 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:nova_api_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1403293212.255:77): pid=15218 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:nova_api_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1403293212.501:78): pid=15218 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:nova_api_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1403293212.501:79): pid=15218 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:nova_api_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1403293212.529:80): pid=15224 uid=162 auid=4294967295 ses=4294967295 subj=system_u:system_r:nova_api_t:s0 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1403293212.530:81): pid=15224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:nova_api_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1403293212.530:82): pid=15224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:nova_api_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1403293212.804:83): table=filter family=2 entries=8
>type=SYSCALL msg=audit(1403293212.804:83): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1ae62d0 items=0 ppid=15225 pid=15233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables-restor" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1403293212.804:84): table=nat family=2 entries=52
>type=SYSCALL msg=audit(1403293212.804:84): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1ae8320 items=0 ppid=15225 pid=15233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables-restor" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1403293212.805:85): table=mangle family=2 entries=40
>type=SYSCALL msg=audit(1403293212.805:85): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1ae72e0 items=0 ppid=15225 pid=15233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables-restor" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1403293212.805:86): table=security family=2 entries=13
>type=SYSCALL msg=audit(1403293212.805:86): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1ae59d0 items=0 ppid=15225 pid=15233 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables-restor" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
>type=USER_END msg=audit(1403293212.810:87): pid=15224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:nova_api_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1403293212.810:88): pid=15224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:nova_api_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293213.799:89): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-ceilometer-notification" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293214.696:90): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-ceilometer-collector" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293215.788:91): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-ceilometer-central" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293216.939:92): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-ceilometer-alarm-notifier" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293217.722:93): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-ceilometer-api" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293218.576:94): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-ceilometer-alarm-evaluator" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293223.968:95): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-keystone" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293235.756:96): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403293246.202:97): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293257.076:98): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="httpd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1403293257.366:99): pid=16569 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:useradd_t:s0 msg='op=adding user to group acct="heat" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1403293257.367:100): pid=16569 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:useradd_t:s0 msg='op=adding user to shadow group acct="heat" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293259.504:101): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-heat-api" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293260.203:102): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-heat-engine" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293264.907:103): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-nova-cert" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293269.191:104): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-glance-registry" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293269.859:105): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="openstack-glance-api" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293496.876:106): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403293507.197:107): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293603.360:108): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-tmpfiles-clean" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403293603.360:109): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-tmpfiles-clean" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403293777.166:110): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403293787.196:111): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403294028.734:112): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403294039.203:113): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294163.004:114): pid=17243 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=0f:0f:0e:da:b2:42:e4:57:6e:75:80:49:f1:61:ec:30 direction=? spid=17243 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294163.004:115): pid=17243 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a4:16:4c:bd:fb:5e:78:3d:e4:c0:35:79:1d:9a:0d:2d direction=? spid=17243 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1403294163.006:116): pid=17242 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5 spid=17243 suid=74 rport=52289 laddr=192.168.0.6 lport= exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1403294163.007:117): pid=17242 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5 spid=17243 suid=74 rport=52289 laddr=192.168.0.6 lport= exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294163.026:118): pid=17242 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=17243 suid=74 rport=52289 laddr=192.168.0.6 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294163.036:119): pid=17242 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=0f:0f:0e:da:b2:42:e4:57:6e:75:80:49:f1:61:ec:30 direction=? spid=17242 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294163.036:120): pid=17242 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a4:16:4c:bd:fb:5e:78:3d:e4:c0:35:79:1d:9a:0d:2d direction=? spid=17242 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=USER_LOGIN msg=audit(1403294163.036:121): pid=17242 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct=28756E6B6E6F776E207573657229 exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=ssh res=failed'
>type=CRYPTO_KEY_USER msg=audit(1403294170.181:122): pid=17247 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=0f:0f:0e:da:b2:42:e4:57:6e:75:80:49:f1:61:ec:30 direction=? spid=17247 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294170.181:123): pid=17247 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a4:16:4c:bd:fb:5e:78:3d:e4:c0:35:79:1d:9a:0d:2d direction=? spid=17247 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1403294170.182:124): pid=17246 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5 spid=17247 suid=74 rport=52290 laddr=192.168.0.6 lport= exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1403294170.182:125): pid=17246 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5 spid=17247 suid=74 rport=52290 laddr=192.168.0.6 lport= exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=USER_AUTH msg=audit(1403294178.148:126): pid=17246 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1403294178.148:127): pid=17246 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="root" exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1403294179.691:128): pid=17246 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1403294179.694:129): pid=17246 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294179.695:130): pid=17246 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=17247 suid=74 rport=52290 laddr=192.168.0.6 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=USER_AUTH msg=audit(1403294179.697:131): pid=17246 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1403294179.698:132): pid=17246 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=LOGIN msg=audit(1403294179.698:133): pid=17246 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=1 res=1
>type=USER_ROLE_CHANGE msg=audit(1403294179.843:134): pid=17246 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=USER_START msg=audit(1403294180.023:135): pid=17246 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1403294180.038:136): pid=17253 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1403294180.038:137): pid=17253 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294180.038:138): pid=17253 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=0f:0f:0e:da:b2:42:e4:57:6e:75:80:49:f1:61:ec:30 direction=? spid=17253 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294180.038:139): pid=17253 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a4:16:4c:bd:fb:5e:78:3d:e4:c0:35:79:1d:9a:0d:2d direction=? spid=17253 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=pts/0 res=success'
>type=CRED_REFR msg=audit(1403294180.039:140): pid=17253 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=SERVICE_START msg=audit(1403294293.060:141): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403294303.211:142): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1403294324.699:143): pid=17246 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_LOGOUT msg=audit(1403294324.700:144): pid=17246 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_END msg=audit(1403294324.713:145): pid=17246 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1403294324.713:146): pid=17246 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294324.714:147): pid=17246 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=0f:0f:0e:da:b2:42:e4:57:6e:75:80:49:f1:61:ec:30 direction=? spid=17246 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294324.714:148): pid=17246 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a4:16:4c:bd:fb:5e:78:3d:e4:c0:35:79:1d:9a:0d:2d direction=? spid=17246 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294324.714:149): pid=17246 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=17246 suid=0 rport=52290 laddr=192.168.0.6 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294448.384:150): pid=17606 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=0f:0f:0e:da:b2:42:e4:57:6e:75:80:49:f1:61:ec:30 direction=? spid=17606 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294448.384:151): pid=17606 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a4:16:4c:bd:fb:5e:78:3d:e4:c0:35:79:1d:9a:0d:2d direction=? spid=17606 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1403294448.386:152): pid=17605 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5 spid=17606 suid=74 rport=52292 laddr=192.168.0.6 lport= exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1403294448.386:153): pid=17605 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5 spid=17606 suid=74 rport=52292 laddr=192.168.0.6 lport= exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=USER_AUTH msg=audit(1403294450.211:154): pid=17605 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1403294450.215:155): pid=17605 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294450.217:156): pid=17605 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=17606 suid=74 rport=52292 laddr=192.168.0.6 lport=22  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=? res=success'
>type=USER_AUTH msg=audit(1403294450.218:157): pid=17605 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1403294450.218:158): pid=17605 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=LOGIN msg=audit(1403294450.219:159): pid=17605 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=2 res=1
>type=USER_ROLE_CHANGE msg=audit(1403294450.312:160): pid=17605 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=USER_START msg=audit(1403294450.338:161): pid=17605 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1403294450.350:162): pid=17609 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1403294450.351:163): pid=17609 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294450.351:164): pid=17609 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=0f:0f:0e:da:b2:42:e4:57:6e:75:80:49:f1:61:ec:30 direction=? spid=17609 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1403294450.351:165): pid=17609 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=a4:16:4c:bd:fb:5e:78:3d:e4:c0:35:79:1d:9a:0d:2d direction=? spid=17609 suid=0  exe="/usr/sbin/sshd" hostname=? addr=192.168.0.250 terminal=pts/0 res=success'
>type=CRED_REFR msg=audit(1403294450.352:166): pid=17609 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=192.168.0.250 addr=192.168.0.250 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1403294461.657:167): pid=17628 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1403294461.657:168): pid=17628 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1403294461.659:169): pid=17628 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=3 res=1
>type=USER_START msg=audit(1403294461.686:170): pid=17628 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1403294461.687:171): pid=17628 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1403294461.850:172): pid=17628 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1403294461.854:173): pid=17628 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=NETFILTER_CFG msg=audit(1403294548.510:174): table=filter family=2 entries=25
>type=SYSCALL msg=audit(1403294548.510:174): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=a83b60 items=0 ppid=17664 pid=17851 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1403294549.555:175): table=filter family=2 entries=26
>type=SYSCALL msg=audit(1403294549.555:175): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=1a2efb0 items=0 ppid=17664 pid=17884 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1403294550.023:176): table=filter family=2 entries=27
>type=SYSCALL msg=audit(1403294550.023:176): arch=c000003e syscall=54 success=yes exit=0 a0=4 a1=0 a2=40 a3=ca6410 items=0 ppid=17664 pid=17917 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="iptables" exe="/usr/sbin/xtables-multi" subj=system_u:system_r:iptables_t:s0 key=(null)
>type=SERVICE_START msg=audit(1403294561.417:177): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="xinetd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403294561.417:178): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="xinetd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403294561.485:179): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="xinetd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1403294566.218:180): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1403294577.217:181): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="NetworkManager-dispatcher" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

Actions: View

Attachments on bug 1105344: 902706 | 907855 | 910173 | 910882