Attachment 913934 Details for Bug 1114254 – audit log with selinux-0.5.8-1

audit log with selinux-0.5.8-1

audit.log (text/plain), 19.18 KB, created by Ofer Blaut on 2014-07-01 21:38:27 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ofer Blaut

Created: 2014-07-01 21:38:27 UTC

Size: 19.18 KB

patch

obsolete

>type=SERVICE_START msg=audit(1404250471.806:12252): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="neutron-lbaas-agent" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1404250471.806:12253): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="neutron-lbaas-agent" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_START msg=audit(1404250471.810:12254): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="neutron-lbaas-agent" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1404250472.374:12255): pid=2903 uid=993 auid=4294967295 ses=4294967295 subj=system_u:system_r:neutron_t:s0 msg='cwd="/" cmd=6E657574726F6E2D726F6F7477726170202F6574632F6E657574726F6E2F726F6F74777261702E636F6E66206970206E65746E73206578656320716C626161732D39383139336136302D383464372D343738652D393065652D63663334653438393836626220686170726F7879202D66202F7661722F6C69622F6E657574726F6E2F6C626161732F39383139336136302D383464372D343738652D393065652D6366333465343839383662622F636F6E66202D70202F7661722F6C69622F6E657574726F6E2F6C626161732F39383139336136302D383464372D343738652D393065652D6366333465343839383662622F706964202D73662032323033 terminal=? res=success'
>type=CRED_ACQ msg=audit(1404250472.374:12256): pid=2903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:neutron_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1404250472.375:12257): pid=2903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:neutron_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=AVC msg=audit(1404250472.427:12258): avc:  denied  { read } for  pid=2905 comm="haproxy" name="conf" dev="sda5" ino=20316189 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=file
>type=AVC msg=audit(1404250472.427:12258): avc:  denied  { open } for  pid=2905 comm="haproxy" path="/var/lib/neutron/lbaas/98193a60-84d7-478e-90ee-cf34e48986bb/conf" dev="sda5" ino=20316189 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1404250472.427:12258): arch=c000003e syscall=2 success=yes exit=3 a0=7fffe6819d88 a1=0 a2=1b6 a3=0 items=0 ppid=2904 pid=2905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="haproxy" exe="/usr/sbin/haproxy" subj=system_u:system_r:haproxy_t:s0 key=(null)
>type=AVC msg=audit(1404250472.427:12259): avc:  denied  { getattr } for  pid=2905 comm="haproxy" path="/var/lib/neutron/lbaas/98193a60-84d7-478e-90ee-cf34e48986bb/conf" dev="sda5" ino=20316189 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1404250472.427:12259): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7fffe6818a60 a2=7fffe6818a60 a3=0 items=0 ppid=2904 pid=2905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="haproxy" exe="/usr/sbin/haproxy" subj=system_u:system_r:haproxy_t:s0 key=(null)
>type=AVC msg=audit(1404250472.428:12260): avc:  denied  { write } for  pid=2905 comm="haproxy" name="98193a60-84d7-478e-90ee-cf34e48986bb" dev="sda5" ino=20316185 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1404250472.428:12260): avc:  denied  { add_name } for  pid=2905 comm="haproxy" name="sock" dev="sda5" ino=20316187 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1404250472.428:12260): avc:  denied  { link } for  pid=2905 comm="haproxy" name="sock" dev="sda5" ino=20316187 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=sock_file
>type=SYSCALL msg=audit(1404250472.428:12260): arch=c000003e syscall=86 success=yes exit=0 a0=7f21b165b54a a1=7fffe6818610 a2=7fffe6818659 a3=0 items=0 ppid=2904 pid=2905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="haproxy" exe="/usr/sbin/haproxy" subj=system_u:system_r:haproxy_t:s0 key=(null)
>type=AVC msg=audit(1404250472.428:12261): avc:  denied  { create } for  pid=2905 comm="haproxy" name="sock.2905.tmp" scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=sock_file
>type=SYSCALL msg=audit(1404250472.428:12261): arch=c000003e syscall=49 success=yes exit=0 a0=4 a1=7fffe68175a0 a2=6e a3=0 items=0 ppid=2904 pid=2905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="haproxy" exe="/usr/sbin/haproxy" subj=system_u:system_r:haproxy_t:s0 key=(null)
>type=AVC msg=audit(1404250472.428:12262): avc:  denied  { setattr } for  pid=2905 comm="haproxy" name="sock.2905.tmp" dev="sda5" ino=20316186 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=sock_file
>type=SYSCALL msg=audit(1404250472.428:12262): arch=c000003e syscall=90 success=yes exit=0 a0=7fffe6817610 a1=1b6 a2=ffffffff a3=0 items=0 ppid=2904 pid=2905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="haproxy" exe="/usr/sbin/haproxy" subj=system_u:system_r:haproxy_t:s0 key=(null)
>type=AVC msg=audit(1404250472.428:12263): avc:  denied  { remove_name } for  pid=2905 comm="haproxy" name="sock.2905.tmp" dev="sda5" ino=20316186 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1404250472.428:12263): avc:  denied  { rename } for  pid=2905 comm="haproxy" name="sock.2905.tmp" dev="sda5" ino=20316186 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=sock_file
>type=AVC msg=audit(1404250472.428:12263): avc:  denied  { unlink } for  pid=2905 comm="haproxy" name="sock" dev="sda5" ino=20316187 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=sock_file
>type=SYSCALL msg=audit(1404250472.428:12263): arch=c000003e syscall=82 success=yes exit=0 a0=7fffe6817610 a1=7f21b165b54a a2=1e a3=7fffe6817598 items=0 ppid=2904 pid=2905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="haproxy" exe="/usr/sbin/haproxy" subj=system_u:system_r:haproxy_t:s0 key=(null)
>type=AVC msg=audit(1404250472.428:12264): avc:  denied  { unlink } for  pid=2905 comm="haproxy" name="pid" dev="sda5" ino=20316188 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1404250472.428:12264): arch=c000003e syscall=87 success=yes exit=0 a0=7f21b1670420 a1=0 a2=0 a3=8 items=0 ppid=2904 pid=2905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="haproxy" exe="/usr/sbin/haproxy" subj=system_u:system_r:haproxy_t:s0 key=(null)
>type=AVC msg=audit(1404250472.428:12265): avc:  denied  { create } for  pid=2905 comm="haproxy" name="pid" scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=file
>type=AVC msg=audit(1404250472.428:12265): avc:  denied  { write } for  pid=2905 comm="haproxy" path="/var/lib/neutron/lbaas/98193a60-84d7-478e-90ee-cf34e48986bb/pid" dev="sda5" ino=20316188 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:neutron_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1404250472.428:12265): arch=c000003e syscall=2 success=yes exit=7 a0=7f21b1670420 a1=241 a2=1a4 a3=8 items=0 ppid=2904 pid=2905 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="haproxy" exe="/usr/sbin/haproxy" subj=system_u:system_r:haproxy_t:s0 key=(null)
>type=USER_END msg=audit(1404250472.433:12266): pid=2903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:neutron_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1404250472.433:12267): pid=2903 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:neutron_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1404250500.019:12268): pid=2921 uid=165 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E6620656E76204C435F414C4C3D4320766773202D2D6E6F68656164696E6773202D2D756E69743D67202D6F206E616D652C73697A652C667265652C6C765F636F756E742C75756964202D2D736570617261746F72203A202D2D6E6F7375666669782063696E6465722D766F6C756D6573 terminal=? res=success'
>type=CRED_ACQ msg=audit(1404250500.019:12269): pid=2921 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1404250500.021:12270): pid=2921 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1404250500.082:12271): pid=2921 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1404250500.082:12272): pid=2921 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1404250501.820:12273): pid=2925 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1404250501.820:12274): pid=2925 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1404250501.821:12275): pid=2925 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=163 old-ses=4294967295 ses=486 res=1
>type=USER_START msg=audit(1404250501.835:12276): pid=2925 uid=0 auid=163 ses=486 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1404250501.836:12277): pid=2925 uid=0 auid=163 ses=486 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1404250502.340:12278): pid=2925 uid=0 auid=163 ses=486 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1404250502.343:12279): pid=2925 uid=0 auid=163 ses=486 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_CMD msg=audit(1404250560.027:12280): pid=2994 uid=165 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='cwd="/" cmd=63696E6465722D726F6F7477726170202F6574632F63696E6465722F726F6F74777261702E636F6E6620656E76204C435F414C4C3D4320766773202D2D6E6F68656164696E6773202D2D756E69743D67202D6F206E616D652C73697A652C667265652C6C765F636F756E742C75756964202D2D736570617261746F72203A202D2D6E6F7375666669782063696E6465722D766F6C756D6573 terminal=? res=success'
>type=CRED_ACQ msg=audit(1404250560.027:12281): pid=2994 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1404250560.029:12282): pid=2994 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1404250560.089:12283): pid=2994 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1404250560.089:12284): pid=2994 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1404250561.354:12285): pid=2998 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1404250561.354:12286): pid=2998 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1404250561.354:12287): pid=2998 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295 auid=163 old-ses=4294967295 ses=487 res=1
>type=USER_START msg=audit(1404250561.367:12288): pid=2998 uid=0 auid=163 ses=487 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1404250561.367:12289): pid=2998 uid=0 auid=163 ses=487 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1404250561.872:12290): pid=2998 uid=0 auid=163 ses=487 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1404250561.874:12291): pid=2998 uid=0 auid=163 ses=487 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="keystone" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1404250586.504:12292): pid=3032 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ba:81:cd:89:8e:5b:82:bd:6b:dc:14:a1:3f:f0:6d:60 direction=? spid=3032 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.36.6.51 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1404250586.504:12293): pid=3032 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=45:69:90:35:da:9f:99:b0:58:e5:e5:e2:74:29:36:e6 direction=? spid=3032 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.36.6.51 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1404250586.647:12294): pid=3031 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5 spid=3032 suid=74 rport=46927 laddr=10.35.160.17 lport= exe="/usr/sbin/sshd" hostname=? addr=10.36.6.51 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1404250586.647:12295): pid=3031 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5 spid=3032 suid=74 rport=46927 laddr=10.35.160.17 lport= exe="/usr/sbin/sshd" hostname=? addr=10.36.6.51 terminal=? res=success'
>type=USER_AUTH msg=audit(1404250592.332:12296): pid=3031 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=46927 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.36.6.51 terminal=? res=success'
>type=USER_AUTH msg=audit(1404250592.332:12297): pid=3031 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=2d:5b:f2:72:4d:c3:8c:98:0d:c0:3c:9e:cb:4a:c3:dc rport=46927 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.36.6.51 terminal=? res=success'
>type=USER_ACCT msg=audit(1404250592.399:12298): pid=3031 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn1-6-51.ams2.redhat.com addr=10.36.6.51 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1404250592.400:12299): pid=3031 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3032 suid=74 rport=46927 laddr=10.35.160.17 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.36.6.51 terminal=? res=success'
>type=USER_AUTH msg=audit(1404250592.401:12300): pid=3031 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.36.6.51 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1404250592.402:12301): pid=3031 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn1-6-51.ams2.redhat.com addr=10.36.6.51 terminal=ssh res=success'
>type=LOGIN msg=audit(1404250592.402:12302): pid=3031 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old-auid=4294967295 auid=0 old-ses=4294967295 ses=488 res=1
>type=USER_ROLE_CHANGE msg=audit(1404250592.475:12303): pid=3031 uid=0 auid=0 ses=488 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=vpn1-6-51.ams2.redhat.com addr=10.36.6.51 terminal=ssh res=success'
>type=USER_START msg=audit(1404250592.493:12304): pid=3031 uid=0 auid=0 ses=488 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn1-6-51.ams2.redhat.com addr=10.36.6.51 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1404250592.694:12305): pid=3031 uid=0 auid=0 ses=488 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn1-6-51.ams2.redhat.com addr=10.36.6.51 terminal=ssh res=success'
>type=USER_START msg=audit(1404250592.695:12306): pid=3031 uid=0 auid=0 ses=488 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn1-6-51.ams2.redhat.com addr=10.36.6.51 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1404250592.697:12307): pid=3036 uid=0 auid=0 ses=488 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ba:81:cd:89:8e:5b:82:bd:6b:dc:14:a1:3f:f0:6d:60 direction=? spid=3036 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.36.6.51 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1404250592.697:12308): pid=3036 uid=0 auid=0 ses=488 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=45:69:90:35:da:9f:99:b0:58:e5:e5:e2:74:29:36:e6 direction=? spid=3036 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.36.6.51 terminal=? res=success'
>type=CRED_REFR msg=audit(1404250592.699:12309): pid=3036 uid=0 auid=0 ses=488 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn1-6-51.ams2.redhat.com addr=10.36.6.51 terminal=ssh res=success'

Actions: View

Attachments on bug 1114254: 913500 | 913934 | 913935