Attachment 920189 Details for Bug 1122457 – /var/log/audit/audit.log on source compute node

/var/log/audit/audit.log on source compute node

audit-source-node.log (text/plain), 631.84 KB, created by Gabriel Szasz on 2014-07-23 10:15:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Gabriel Szasz

Created: 2014-07-23 10:15:18 UTC

Size: 631.84 KB

patch

obsolete

>type=USER_ACCT msg=audit(1406072401.211:17): user pid=6368 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406072401.212:18): user pid=6368 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406072401.224:19): pid=6368 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
>type=USER_START msg=audit(1406072401.232:20): user pid=6368 uid=0 auid=0 ses=1 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406072401.304:21): user pid=6368 uid=0 auid=0 ses=1 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406072401.305:22): user pid=6368 uid=0 auid=0 ses=1 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406073001.321:23): user pid=6588 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406073001.321:24): user pid=6588 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406073001.326:25): pid=6588 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
>type=USER_START msg=audit(1406073001.331:26): user pid=6588 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406073001.398:27): user pid=6588 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406073001.398:28): user pid=6588 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406073601.405:29): user pid=6592 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406073601.405:30): user pid=6592 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406073601.405:31): pid=6592 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
>type=USER_START msg=audit(1406073601.414:32): user pid=6592 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406073601.467:33): user pid=6592 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406073601.467:34): user pid=6592 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406073661.471:35): user pid=6596 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406073661.472:36): user pid=6596 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406073661.472:37): pid=6596 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
>type=USER_START msg=audit(1406073661.477:38): user pid=6596 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406073661.576:39): user pid=6596 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406073661.576:40): user pid=6596 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406074201.583:41): user pid=6612 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406074201.583:42): user pid=6612 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406074201.584:43): pid=6612 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
>type=USER_START msg=audit(1406074201.592:44): user pid=6612 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406074201.640:45): user pid=6612 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406074201.640:46): user pid=6612 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406074801.647:47): user pid=6616 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406074801.647:48): user pid=6616 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406074801.647:49): pid=6616 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
>type=USER_START msg=audit(1406074801.653:50): user pid=6616 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406074801.685:51): user pid=6616 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406074801.685:52): user pid=6616 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406075401.711:53): user pid=14989 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406075401.712:54): user pid=14989 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406075401.715:55): pid=14989 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
>type=USER_START msg=audit(1406075401.721:56): user pid=14989 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406075401.782:57): user pid=14989 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406075401.783:58): user pid=14989 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406076001.793:59): user pid=14995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406076001.793:60): user pid=14995 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406076001.794:61): pid=14995 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
>type=USER_START msg=audit(1406076001.802:62): user pid=14995 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406076001.863:63): user pid=14995 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406076001.863:64): user pid=14995 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406076601.869:65): user pid=15001 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406076601.869:66): user pid=15001 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406076601.869:67): pid=15001 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=9
>type=USER_START msg=audit(1406076601.878:68): user pid=15001 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406076601.924:69): user pid=15001 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406076601.924:70): user pid=15001 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406077201.931:71): user pid=15004 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406077201.931:72): user pid=15004 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406077201.932:73): pid=15004 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=10
>type=USER_START msg=audit(1406077201.938:74): user pid=15004 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406077201.978:75): user pid=15004 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406077201.978:76): user pid=15004 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406077261.983:77): user pid=15008 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406077261.983:78): user pid=15008 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406077261.984:79): pid=15008 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=11
>type=USER_START msg=audit(1406077261.989:80): user pid=15008 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406077262.005:81): user pid=15008 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406077262.005:82): user pid=15008 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406077801.011:83): user pid=15029 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406077801.011:84): user pid=15029 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406077801.012:85): pid=15029 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=12
>type=USER_START msg=audit(1406077801.017:86): user pid=15029 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406077801.060:87): user pid=15029 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406077801.060:88): user pid=15029 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406078401.066:89): user pid=15032 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406078401.066:90): user pid=15032 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406078401.067:91): pid=15032 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=13
>type=USER_START msg=audit(1406078401.074:92): user pid=15032 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406078401.130:93): user pid=15032 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406078401.130:94): user pid=15032 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406079001.137:95): user pid=15036 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406079001.137:96): user pid=15036 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406079001.137:97): pid=15036 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=14
>type=USER_START msg=audit(1406079001.143:98): user pid=15036 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406079001.201:99): user pid=15036 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406079001.201:100): user pid=15036 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406079601.208:101): user pid=15043 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406079601.208:102): user pid=15043 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406079601.208:103): pid=15043 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=15
>type=USER_START msg=audit(1406079601.214:104): user pid=15043 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406079601.272:105): user pid=15043 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406079601.272:106): user pid=15043 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406080201.279:107): user pid=15046 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406080201.279:108): user pid=15046 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406080201.280:109): pid=15046 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=16
>type=USER_START msg=audit(1406080201.285:110): user pid=15046 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406080201.343:111): user pid=15046 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406080201.343:112): user pid=15046 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406080801.350:113): user pid=15050 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406080801.351:114): user pid=15050 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406080801.351:115): pid=15050 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=17
>type=USER_START msg=audit(1406080801.355:116): user pid=15050 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406080801.398:117): user pid=15050 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406080801.398:118): user pid=15050 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406080861.402:119): user pid=15054 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406080861.402:120): user pid=15054 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406080861.403:121): pid=15054 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=18
>type=USER_START msg=audit(1406080861.408:122): user pid=15054 uid=0 auid=0 ses=18 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406080861.421:123): user pid=15054 uid=0 auid=0 ses=18 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406080861.421:124): user pid=15054 uid=0 auid=0 ses=18 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406081401.428:125): user pid=15066 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406081401.428:126): user pid=15066 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406081401.429:127): pid=15066 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=19
>type=USER_START msg=audit(1406081401.434:128): user pid=15066 uid=0 auid=0 ses=19 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406081401.478:129): user pid=15066 uid=0 auid=0 ses=19 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406081401.478:130): user pid=15066 uid=0 auid=0 ses=19 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406082001.486:131): user pid=15070 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406082001.486:132): user pid=15070 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406082001.486:133): pid=15070 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=20
>type=USER_START msg=audit(1406082001.490:134): user pid=15070 uid=0 auid=0 ses=20 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406082001.541:135): user pid=15070 uid=0 auid=0 ses=20 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406082001.541:136): user pid=15070 uid=0 auid=0 ses=20 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406082601.548:137): user pid=15074 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406082601.548:138): user pid=15074 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406082601.548:139): pid=15074 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=21
>type=USER_START msg=audit(1406082601.554:140): user pid=15074 uid=0 auid=0 ses=21 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406082601.611:141): user pid=15074 uid=0 auid=0 ses=21 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406082601.611:142): user pid=15074 uid=0 auid=0 ses=21 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406083201.619:143): user pid=15081 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406083201.620:144): user pid=15081 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406083201.620:145): pid=15081 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=22
>type=USER_START msg=audit(1406083201.625:146): user pid=15081 uid=0 auid=0 ses=22 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406083201.682:147): user pid=15081 uid=0 auid=0 ses=22 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406083201.682:148): user pid=15081 uid=0 auid=0 ses=22 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406083801.689:149): user pid=15084 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406083801.689:150): user pid=15084 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406083801.690:151): pid=15084 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=23
>type=USER_START msg=audit(1406083801.696:152): user pid=15084 uid=0 auid=0 ses=23 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406083801.744:153): user pid=15084 uid=0 auid=0 ses=23 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406083801.744:154): user pid=15084 uid=0 auid=0 ses=23 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406084401.752:155): user pid=15088 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406084401.753:156): user pid=15088 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406084401.753:157): pid=15088 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=24
>type=USER_START msg=audit(1406084401.759:158): user pid=15088 uid=0 auid=0 ses=24 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406084401.798:159): user pid=15088 uid=0 auid=0 ses=24 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406084401.798:160): user pid=15088 uid=0 auid=0 ses=24 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406084461.803:161): user pid=15092 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406084461.803:162): user pid=15092 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406084461.804:163): pid=15092 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=25
>type=USER_START msg=audit(1406084461.812:164): user pid=15092 uid=0 auid=0 ses=25 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406084461.825:165): user pid=15092 uid=0 auid=0 ses=25 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406084461.825:166): user pid=15092 uid=0 auid=0 ses=25 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406085001.833:167): user pid=15104 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406085001.833:168): user pid=15104 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406085001.833:169): pid=15104 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=26
>type=USER_START msg=audit(1406085001.837:170): user pid=15104 uid=0 auid=0 ses=26 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406085001.887:171): user pid=15104 uid=0 auid=0 ses=26 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406085001.887:172): user pid=15104 uid=0 auid=0 ses=26 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406085601.894:173): user pid=15108 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406085601.894:174): user pid=15108 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406085601.895:175): pid=15108 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=27
>type=USER_START msg=audit(1406085601.900:176): user pid=15108 uid=0 auid=0 ses=27 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406085601.941:177): user pid=15108 uid=0 auid=0 ses=27 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406085601.941:178): user pid=15108 uid=0 auid=0 ses=27 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406086201.947:179): user pid=15112 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406086201.948:180): user pid=15112 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406086201.948:181): pid=15112 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=28
>type=USER_START msg=audit(1406086201.953:182): user pid=15112 uid=0 auid=0 ses=28 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406086202.028:183): user pid=15112 uid=0 auid=0 ses=28 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406086202.028:184): user pid=15112 uid=0 auid=0 ses=28 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406086801.035:185): user pid=15120 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406086801.036:186): user pid=15120 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406086801.036:187): pid=15120 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=29
>type=USER_START msg=audit(1406086801.041:188): user pid=15120 uid=0 auid=0 ses=29 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406086801.108:189): user pid=15120 uid=0 auid=0 ses=29 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406086801.108:190): user pid=15120 uid=0 auid=0 ses=29 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406087401.115:191): user pid=15123 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406087401.115:192): user pid=15123 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406087401.116:193): pid=15123 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=30
>type=USER_START msg=audit(1406087401.122:194): user pid=15123 uid=0 auid=0 ses=30 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406087401.195:195): user pid=15123 uid=0 auid=0 ses=30 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406087401.195:196): user pid=15123 uid=0 auid=0 ses=30 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406087581.200:197): user pid=15127 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406087581.201:198): user pid=15127 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406087581.201:199): pid=15127 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=31
>type=USER_START msg=audit(1406087581.207:200): user pid=15127 uid=0 auid=0 ses=31 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406087581.230:201): user pid=15127 uid=0 auid=0 ses=31 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406087581.230:202): user pid=15127 uid=0 auid=0 ses=31 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406088001.238:203): user pid=15136 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406088001.238:204): user pid=15136 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406088001.239:205): pid=15136 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=32
>type=USER_START msg=audit(1406088001.244:206): user pid=15136 uid=0 auid=0 ses=32 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406088001.283:207): user pid=15136 uid=0 auid=0 ses=32 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406088001.283:208): user pid=15136 uid=0 auid=0 ses=32 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406088061.288:209): user pid=15140 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406088061.288:210): user pid=15140 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406088061.288:211): pid=15140 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=33
>type=USER_START msg=audit(1406088061.293:212): user pid=15140 uid=0 auid=0 ses=33 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406088061.324:213): user pid=15140 uid=0 auid=0 ses=33 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406088061.325:214): user pid=15140 uid=0 auid=0 ses=33 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406088601.333:215): user pid=15156 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406088601.333:216): user pid=15156 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406088601.334:217): pid=15156 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=34
>type=USER_START msg=audit(1406088601.338:218): user pid=15156 uid=0 auid=0 ses=34 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406088601.379:219): user pid=15156 uid=0 auid=0 ses=34 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406088601.379:220): user pid=15156 uid=0 auid=0 ses=34 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406089201.386:221): user pid=15160 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406089201.386:222): user pid=15160 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406089201.387:223): pid=15160 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=35
>type=USER_START msg=audit(1406089201.393:224): user pid=15160 uid=0 auid=0 ses=35 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406089201.457:225): user pid=15160 uid=0 auid=0 ses=35 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406089201.458:226): user pid=15160 uid=0 auid=0 ses=35 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406089801.464:227): user pid=15164 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406089801.464:228): user pid=15164 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406089801.465:229): pid=15164 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=36
>type=USER_START msg=audit(1406089801.471:230): user pid=15164 uid=0 auid=0 ses=36 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406089801.511:231): user pid=15164 uid=0 auid=0 ses=36 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406089801.511:232): user pid=15164 uid=0 auid=0 ses=36 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406090401.518:233): user pid=15171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406090401.518:234): user pid=15171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406090401.519:235): pid=15171 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=37
>type=USER_START msg=audit(1406090401.524:236): user pid=15171 uid=0 auid=0 ses=37 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406090401.566:237): user pid=15171 uid=0 auid=0 ses=37 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406090401.566:238): user pid=15171 uid=0 auid=0 ses=37 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406091001.573:239): user pid=15174 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406091001.573:240): user pid=15174 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406091001.574:241): pid=15174 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=38
>type=USER_START msg=audit(1406091001.579:242): user pid=15174 uid=0 auid=0 ses=38 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406091001.653:243): user pid=15174 uid=0 auid=0 ses=38 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406091001.653:244): user pid=15174 uid=0 auid=0 ses=38 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406091601.661:245): user pid=15178 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406091601.661:246): user pid=15178 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406091601.661:247): pid=15178 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=39
>type=USER_START msg=audit(1406091601.666:248): user pid=15178 uid=0 auid=0 ses=39 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406091601.716:249): user pid=15178 uid=0 auid=0 ses=39 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406091601.716:250): user pid=15178 uid=0 auid=0 ses=39 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406091661.720:251): user pid=15182 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406091661.720:252): user pid=15182 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406091661.721:253): pid=15182 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=40
>type=USER_START msg=audit(1406091661.727:254): user pid=15182 uid=0 auid=0 ses=40 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406091661.746:255): user pid=15182 uid=0 auid=0 ses=40 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406091661.746:256): user pid=15182 uid=0 auid=0 ses=40 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406092201.755:257): user pid=15198 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406092201.755:258): user pid=15198 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406092201.756:259): pid=15198 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=41
>type=USER_START msg=audit(1406092201.760:260): user pid=15198 uid=0 auid=0 ses=41 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406092201.803:261): user pid=15198 uid=0 auid=0 ses=41 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406092201.803:262): user pid=15198 uid=0 auid=0 ses=41 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406092801.811:263): user pid=15202 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406092801.811:264): user pid=15202 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406092801.811:265): pid=15202 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=42
>type=USER_START msg=audit(1406092801.817:266): user pid=15202 uid=0 auid=0 ses=42 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406092801.865:267): user pid=15202 uid=0 auid=0 ses=42 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406092801.865:268): user pid=15202 uid=0 auid=0 ses=42 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406093401.871:269): user pid=15206 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406093401.871:270): user pid=15206 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406093401.872:271): pid=15206 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=43
>type=USER_START msg=audit(1406093401.877:272): user pid=15206 uid=0 auid=0 ses=43 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406093401.927:273): user pid=15206 uid=0 auid=0 ses=43 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406093401.927:274): user pid=15206 uid=0 auid=0 ses=43 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406094001.933:275): user pid=15213 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406094001.933:276): user pid=15213 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406094001.934:277): pid=15213 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=44
>type=USER_START msg=audit(1406094001.939:278): user pid=15213 uid=0 auid=0 ses=44 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406094001.989:279): user pid=15213 uid=0 auid=0 ses=44 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406094001.989:280): user pid=15213 uid=0 auid=0 ses=44 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406094601.997:281): user pid=15216 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406094601.997:282): user pid=15216 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406094601.997:283): pid=15216 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=45
>type=USER_START msg=audit(1406094602.003:284): user pid=15216 uid=0 auid=0 ses=45 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406094602.069:285): user pid=15216 uid=0 auid=0 ses=45 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406094602.069:286): user pid=15216 uid=0 auid=0 ses=45 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406095201.074:287): user pid=15220 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406095201.075:288): user pid=15220 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406095201.075:289): pid=15220 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=46
>type=USER_START msg=audit(1406095201.081:290): user pid=15220 uid=0 auid=0 ses=46 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406095201.130:291): user pid=15220 uid=0 auid=0 ses=46 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406095201.130:292): user pid=15220 uid=0 auid=0 ses=46 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406095261.136:293): user pid=15224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406095261.136:294): user pid=15224 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406095261.136:295): pid=15224 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=47
>type=USER_START msg=audit(1406095261.141:296): user pid=15224 uid=0 auid=0 ses=47 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406095261.160:297): user pid=15224 uid=0 auid=0 ses=47 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406095261.161:298): user pid=15224 uid=0 auid=0 ses=47 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406095801.166:299): user pid=15240 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406095801.166:300): user pid=15240 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406095801.167:301): pid=15240 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=48
>type=USER_START msg=audit(1406095801.173:302): user pid=15240 uid=0 auid=0 ses=48 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406095801.243:303): user pid=15240 uid=0 auid=0 ses=48 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406095801.243:304): user pid=15240 uid=0 auid=0 ses=48 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406096401.250:305): user pid=15244 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406096401.250:306): user pid=15244 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406096401.251:307): pid=15244 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=49
>type=USER_START msg=audit(1406096401.256:308): user pid=15244 uid=0 auid=0 ses=49 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406096401.297:309): user pid=15244 uid=0 auid=0 ses=49 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406096401.297:310): user pid=15244 uid=0 auid=0 ses=49 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406097001.303:311): user pid=15248 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406097001.303:312): user pid=15248 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406097001.304:313): pid=15248 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=50
>type=USER_START msg=audit(1406097001.308:314): user pid=15248 uid=0 auid=0 ses=50 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406097001.400:315): user pid=15248 uid=0 auid=0 ses=50 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406097001.400:316): user pid=15248 uid=0 auid=0 ses=50 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406097601.407:317): user pid=15255 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406097601.407:318): user pid=15255 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406097601.408:319): pid=15255 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=51
>type=USER_START msg=audit(1406097601.413:320): user pid=15255 uid=0 auid=0 ses=51 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406097601.495:321): user pid=15255 uid=0 auid=0 ses=51 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406097601.495:322): user pid=15255 uid=0 auid=0 ses=51 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406098201.504:323): user pid=15258 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406098201.504:324): user pid=15258 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406098201.504:325): pid=15258 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=52
>type=USER_START msg=audit(1406098201.510:326): user pid=15258 uid=0 auid=0 ses=52 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406098201.599:327): user pid=15258 uid=0 auid=0 ses=52 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406098201.599:328): user pid=15258 uid=0 auid=0 ses=52 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1406098601.874:329): user pid=15263 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=15263 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406098601.875:330): user pid=15263 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=15263 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406098602.139:331): user pid=15262 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=15263 suid=74 rport=50908 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406098602.139:332): user pid=15262 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=15263 suid=74 rport=50908 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_AUTH msg=audit(1406098629.526:333): user pid=15262 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=50908 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_AUTH msg=audit(1406098629.526:334): user pid=15262 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=30:fc:fa:a3:71:ac:1b:8b:03:8b:4e:4b:5f:37:dc:af rport=50908 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_ACCT msg=audit(1406098629.531:335): user pid=15262 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406098629.533:336): user pid=15262 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=15263 suid=74 rport=50908 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_AUTH msg=audit(1406098629.533:337): user pid=15262 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406098629.534:338): user pid=15262 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=LOGIN msg=audit(1406098629.534:339): pid=15262 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=53
>type=USER_ROLE_CHANGE msg=audit(1406098629.650:340): user pid=15262 uid=0 auid=0 ses=53 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_START msg=audit(1406098629.654:341): user pid=15262 uid=0 auid=0 ses=53 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406098630.058:342): user pid=15266 uid=0 auid=0 ses=53 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1406098630.059:343): user pid=15266 uid=0 auid=0 ses=53 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1406098630.059:344): user pid=15266 uid=0 auid=0 ses=53 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=15266 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1406098630.059:345): user pid=15266 uid=0 auid=0 ses=53 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=15266 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=pts/0 res=success'
>type=CRED_REFR msg=audit(1406098630.060:346): user pid=15266 uid=0 auid=0 ses=53 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1406098801.628:347): user pid=15283 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406098801.628:348): user pid=15283 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406098801.635:349): pid=15283 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=54
>type=USER_START msg=audit(1406098801.642:350): user pid=15283 uid=0 auid=0 ses=54 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406098801.769:351): user pid=15283 uid=0 auid=0 ses=54 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406098801.769:352): user pid=15283 uid=0 auid=0 ses=54 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406098861.776:353): user pid=15286 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406098861.776:354): user pid=15286 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406098861.776:355): pid=15286 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=55
>type=USER_START msg=audit(1406098861.783:356): user pid=15286 uid=0 auid=0 ses=55 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406098861.823:357): user pid=15286 uid=0 auid=0 ses=55 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406098861.823:358): user pid=15286 uid=0 auid=0 ses=55 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406099401.843:359): user pid=21101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406099401.843:360): user pid=21101 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406099401.845:361): pid=21101 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=56
>type=USER_START msg=audit(1406099401.850:362): user pid=21101 uid=0 auid=0 ses=56 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406099401.968:363): user pid=21101 uid=0 auid=0 ses=56 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406099401.968:364): user pid=21101 uid=0 auid=0 ses=56 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406100001.976:365): user pid=21104 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406100001.976:366): user pid=21104 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406100001.976:367): pid=21104 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=57
>type=USER_START msg=audit(1406100001.981:368): user pid=21104 uid=0 auid=0 ses=57 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406100002.064:369): user pid=21104 uid=0 auid=0 ses=57 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406100002.064:370): user pid=21104 uid=0 auid=0 ses=57 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406100601.070:371): user pid=21108 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406100601.070:372): user pid=21108 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406100601.071:373): pid=21108 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=58
>type=USER_START msg=audit(1406100601.076:374): user pid=21108 uid=0 auid=0 ses=58 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406100601.150:375): user pid=21108 uid=0 auid=0 ses=58 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406100601.150:376): user pid=21108 uid=0 auid=0 ses=58 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406101201.160:377): user pid=21116 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406101201.160:378): user pid=21116 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406101201.160:379): pid=21116 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=59
>type=USER_START msg=audit(1406101201.168:380): user pid=21116 uid=0 auid=0 ses=59 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406101201.221:381): user pid=21116 uid=0 auid=0 ses=59 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406101201.221:382): user pid=21116 uid=0 auid=0 ses=59 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406101801.227:383): user pid=21119 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406101801.227:384): user pid=21119 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406101801.228:385): pid=21119 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=60
>type=USER_START msg=audit(1406101801.233:386): user pid=21119 uid=0 auid=0 ses=60 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406101801.307:387): user pid=21119 uid=0 auid=0 ses=60 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406101801.307:388): user pid=21119 uid=0 auid=0 ses=60 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406102401.315:389): user pid=21123 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406102401.315:390): user pid=21123 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406102401.315:391): pid=21123 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=61
>type=USER_START msg=audit(1406102401.320:392): user pid=21123 uid=0 auid=0 ses=61 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406102401.394:393): user pid=21123 uid=0 auid=0 ses=61 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406102401.394:394): user pid=21123 uid=0 auid=0 ses=61 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406102461.399:395): user pid=21127 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406102461.399:396): user pid=21127 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406102461.399:397): pid=21127 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=62
>type=USER_START msg=audit(1406102461.408:398): user pid=21127 uid=0 auid=0 ses=62 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406102461.425:399): user pid=21127 uid=0 auid=0 ses=62 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406102461.425:400): user pid=21127 uid=0 auid=0 ses=62 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406103001.432:401): user pid=21139 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406103001.432:402): user pid=21139 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406103001.432:403): pid=21139 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=63
>type=USER_START msg=audit(1406103001.438:404): user pid=21139 uid=0 auid=0 ses=63 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406103001.490:405): user pid=21139 uid=0 auid=0 ses=63 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406103001.490:406): user pid=21139 uid=0 auid=0 ses=63 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406103601.496:407): user pid=21143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406103601.496:408): user pid=21143 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406103601.497:409): pid=21143 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=64
>type=USER_START msg=audit(1406103601.502:410): user pid=21143 uid=0 auid=0 ses=64 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406103601.561:411): user pid=21143 uid=0 auid=0 ses=64 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406103601.561:412): user pid=21143 uid=0 auid=0 ses=64 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104077.178:413): user pid=21148 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=21148 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104077.178:414): user pid=21148 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=21148 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406104077.180:415): user pid=21147 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=21148 suid=74 rport=50925 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406104077.180:416): user pid=21147 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=21148 suid=74 rport=50925 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406104077.239:417): user pid=21147 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1406104077.257:418): user pid=21147 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1406104077.261:419): user pid=21147 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104077.262:420): user pid=21147 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=21148 suid=74 rport=50925 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406104077.263:421): user pid=21147 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406104077.263:422): user pid=21147 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406104077.264:423): pid=21147 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=65
>type=USER_ROLE_CHANGE msg=audit(1406104077.342:424): user pid=21147 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406104077.345:425): user pid=21147 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406104077.348:426): user pid=21147 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406104077.349:427): user pid=21147 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104077.349:428): user pid=21151 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=21151 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104077.349:429): user pid=21151 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=21151 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406104077.350:430): user pid=21151 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406104077.478:431): user pid=21147 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406104077.479:432): user pid=21147 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406104077.479:433): user pid=21147 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406104077.480:434): user pid=21147 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104077.480:435): user pid=21147 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=21147 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104077.481:436): user pid=21147 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=21147 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104077.481:437): user pid=21147 uid=0 auid=0 ses=65 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=21147 suid=0 rport=50925 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104079.435:438): user pid=21162 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=21162 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104079.436:439): user pid=21162 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=21162 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406104079.436:440): user pid=21161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=21162 suid=74 rport=50928 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406104079.436:441): user pid=21161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=21162 suid=74 rport=50928 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406104079.499:442): user pid=21161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=50928 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406104079.499:443): user pid=21161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=50928 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406104079.505:444): user pid=21161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104079.506:445): user pid=21161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=21162 suid=74 rport=50928 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406104079.506:446): user pid=21161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406104079.507:447): user pid=21161 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406104079.507:448): pid=21161 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=66
>type=USER_ROLE_CHANGE msg=audit(1406104079.576:449): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406104079.580:450): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406104079.583:451): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406104079.584:452): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406104079.586:453): user pid=21164 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=/dev/pts/1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104079.586:454): user pid=21164 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=21164 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=pts/1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104079.586:455): user pid=21164 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=21164 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=pts/1 res=success'
>type=CRED_REFR msg=audit(1406104079.587:456): user pid=21164 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406104079.629:457): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/1 res=success'
>type=USER_END msg=audit(1406104079.630:458): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406104079.631:459): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406104079.632:460): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406104079.633:461): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104079.633:462): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=21161 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104079.633:463): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=21161 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104079.633:464): user pid=21161 uid=0 auid=0 ses=66 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=21161 suid=0 rport=50928 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104080.580:465): user pid=21172 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=21172 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104080.580:466): user pid=21172 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=21172 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406104080.580:467): user pid=21171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=21172 suid=74 rport=50931 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406104080.580:468): user pid=21171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=21172 suid=74 rport=50931 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406104080.643:469): user pid=21171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=50931 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406104080.643:470): user pid=21171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=50931 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406104080.650:471): user pid=21171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104080.650:472): user pid=21171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=21172 suid=74 rport=50931 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406104080.651:473): user pid=21171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406104080.652:474): user pid=21171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406104080.652:475): pid=21171 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=67
>type=USER_ROLE_CHANGE msg=audit(1406104080.723:476): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406104080.726:477): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406104080.729:478): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406104080.729:479): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406104080.731:480): user pid=21174 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=/dev/pts/1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104080.731:481): user pid=21174 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=21174 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=pts/1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104080.731:482): user pid=21174 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=21174 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=pts/1 res=success'
>type=CRED_REFR msg=audit(1406104080.732:483): user pid=21174 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_ACCT msg=audit(1406104201.589:484): user pid=21227 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406104201.589:485): user pid=21227 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406104201.597:486): pid=21227 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=68
>type=USER_START msg=audit(1406104201.604:487): user pid=21227 uid=0 auid=0 ses=68 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406104201.733:488): user pid=21227 uid=0 auid=0 ses=68 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406104201.733:489): user pid=21227 uid=0 auid=0 ses=68 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104202.394:490): user pid=5546 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=5546 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104202.394:491): user pid=5546 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=5546 suid=0  exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1406104277.721:492): user pid=21399 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="postfix" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
>type=ADD_USER msg=audit(1406104277.721:493): user pid=21399 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="postfix" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
>type=ADD_USER msg=audit(1406104281.389:494): user pid=21836 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
>type=ADD_USER msg=audit(1406104281.389:495): user pid=21836 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
>type=USER_ACCT msg=audit(1406104281.495:496): user pid=21841 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=changing /etc/group; group nfsnobody/65534 acct="nfsnobody" exe="/usr/sbin/groupmod" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1406104281.497:497): user pid=21841 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=modifying group acct="nfsnobody" exe="/usr/sbin/groupmod" hostname=? addr=? terminal=? res=success'
>type=MAC_POLICY_LOAD msg=audit(1406104308.455:498): policy loaded auid=0 ses=67
>type=SYSCALL msg=audit(1406104308.455:498): arch=c000003e syscall=1 success=yes exit=7295329 a0=4 a1=7fe71d04a000 a2=6f5161 a3=7fffbc3ccb50 items=0 ppid=21864 pid=21869 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=67 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=DAEMON_END msg=audit(1406104353.253:1535): auditd normal halt, sending auid=0 pid=22037 subj=unconfined_u:system_r:initrc_t:s0 res=success
>type=DAEMON_START msg=audit(1406104353.392:5448): auditd start, ver=2.2 format=raw kernel=2.6.32-431.el6.x86_64 auid=0 pid=22057 subj=unconfined_u:system_r:auditd_t:s0 res=success
>type=CONFIG_CHANGE msg=audit(1406104353.499:501): audit_backlog_limit=320 old=320 auid=0 ses=67 subj=unconfined_u:system_r:auditctl_t:s0 res=1
>type=USER_END msg=audit(1406104426.164:502): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/1 res=success'
>type=USER_END msg=audit(1406104426.232:503): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406104426.233:504): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406104426.234:505): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406104426.234:506): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104426.235:507): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=21171 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104426.235:508): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=21171 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406104426.235:509): user pid=21171 uid=0 auid=0 ses=67 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=21171 suid=0 rport=50931 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406104801.922:510): user pid=31366 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406104801.922:511): user pid=31366 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406104801.929:512): pid=31366 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=69
>type=USER_START msg=audit(1406104801.936:513): user pid=31366 uid=0 auid=0 ses=69 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406104801.999:514): user pid=31366 uid=0 auid=0 ses=69 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406104801.999:515): user pid=31366 uid=0 auid=0 ses=69 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105375.119:516): user pid=31369 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31369 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105375.119:517): user pid=31369 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31369 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105375.524:518): user pid=31371 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31371 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105375.524:519): user pid=31371 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31371 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105375.525:520): user pid=31370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31371 suid=74 rport=50938 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105375.525:521): user pid=31370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31371 suid=74 rport=50938 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105375.586:522): user pid=31370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=50938 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105375.586:523): user pid=31370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=50938 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105375.593:524): user pid=31370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105375.594:525): user pid=31370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31371 suid=74 rport=50938 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105375.595:526): user pid=31370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105375.595:527): user pid=31370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105375.596:528): pid=31370 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=70
>type=USER_ROLE_CHANGE msg=audit(1406105375.674:529): user pid=31370 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105375.682:530): user pid=31370 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105375.684:531): user pid=31370 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105375.685:532): user pid=31370 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105375.686:533): user pid=31373 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31373 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105375.686:534): user pid=31373 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31373 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105375.687:535): user pid=31373 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105375.828:536): user pid=31370 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105375.828:537): user pid=31370 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105375.830:538): user pid=31370 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105375.830:539): user pid=31370 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105375.830:540): user pid=31370 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31370 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105375.831:541): user pid=31370 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31370 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105375.831:542): user pid=31370 uid=0 auid=0 ses=70 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31370 suid=0 rport=50938 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.598:543): user pid=31387 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31387 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.598:544): user pid=31387 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31387 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105376.599:545): user pid=31386 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31387 suid=74 rport=50942 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105376.599:546): user pid=31386 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31387 suid=74 rport=50942 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105376.659:547): user pid=31386 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=50942 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105376.659:548): user pid=31386 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=50942 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105376.668:549): user pid=31386 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.668:550): user pid=31386 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31387 suid=74 rport=50942 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105376.669:551): user pid=31386 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105376.669:552): user pid=31386 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105376.669:553): pid=31386 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=71
>type=USER_ROLE_CHANGE msg=audit(1406105376.743:554): user pid=31386 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105376.754:555): user pid=31386 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105376.757:556): user pid=31386 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105376.757:557): user pid=31386 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.758:558): user pid=31389 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31389 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.758:559): user pid=31389 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31389 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105376.759:560): user pid=31389 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105376.804:561): user pid=31386 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105376.805:562): user pid=31386 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105376.806:563): user pid=31386 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105376.806:564): user pid=31386 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.807:565): user pid=31386 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31386 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.807:566): user pid=31386 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31386 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.807:567): user pid=31386 uid=0 auid=0 ses=71 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31386 suid=0 rport=50942 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.819:568): user pid=31398 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31398 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.819:569): user pid=31398 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31398 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105376.820:570): user pid=31397 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31398 suid=74 rport=50943 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105376.820:571): user pid=31397 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31398 suid=74 rport=50943 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105376.880:572): user pid=31397 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=50943 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105376.880:573): user pid=31397 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=50943 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105376.888:574): user pid=31397 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.888:575): user pid=31397 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31398 suid=74 rport=50943 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105376.889:576): user pid=31397 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105376.890:577): user pid=31397 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105376.890:578): pid=31397 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=72
>type=USER_ROLE_CHANGE msg=audit(1406105376.964:579): user pid=31397 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105376.975:580): user pid=31397 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105376.977:581): user pid=31397 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105376.978:582): user pid=31397 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.979:583): user pid=31400 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31400 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105376.979:584): user pid=31400 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31400 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105376.980:585): user pid=31400 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105377.028:586): user pid=31397 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105377.028:587): user pid=31397 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105377.029:588): user pid=31397 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105377.030:589): user pid=31397 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105377.030:590): user pid=31397 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31397 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105377.030:591): user pid=31397 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31397 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105377.030:592): user pid=31397 uid=0 auid=0 ses=72 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31397 suid=0 rport=50943 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.187:593): user pid=31412 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31412 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.187:594): user pid=31412 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31412 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105386.187:595): user pid=31411 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31412 suid=74 rport=50949 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105386.187:596): user pid=31411 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31412 suid=74 rport=50949 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105386.246:597): user pid=31411 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=50949 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105386.246:598): user pid=31411 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=50949 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105386.253:599): user pid=31411 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.253:600): user pid=31411 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31412 suid=74 rport=50949 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105386.254:601): user pid=31411 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105386.255:602): user pid=31411 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105386.255:603): pid=31411 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=73
>type=USER_ROLE_CHANGE msg=audit(1406105386.326:604): user pid=31411 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105386.336:605): user pid=31411 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105386.338:606): user pid=31411 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105386.339:607): user pid=31411 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.340:608): user pid=31414 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31414 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.340:609): user pid=31414 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31414 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105386.341:610): user pid=31414 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105386.420:611): user pid=31411 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105386.421:612): user pid=31411 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105386.422:613): user pid=31411 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105386.422:614): user pid=31411 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.422:615): user pid=31411 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31411 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.422:616): user pid=31411 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31411 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.422:617): user pid=31411 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31411 suid=0 rport=50949 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.434:618): user pid=31423 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31423 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.434:619): user pid=31423 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31423 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105386.435:620): user pid=31422 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31423 suid=74 rport=50950 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105386.435:621): user pid=31422 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31423 suid=74 rport=50950 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105386.496:622): user pid=31422 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=50950 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105386.496:623): user pid=31422 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=50950 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105386.503:624): user pid=31422 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.503:625): user pid=31422 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31423 suid=74 rport=50950 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105386.504:626): user pid=31422 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105386.507:627): user pid=31422 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105386.507:628): pid=31422 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=74
>type=USER_ROLE_CHANGE msg=audit(1406105386.579:629): user pid=31422 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105386.588:630): user pid=31422 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105386.591:631): user pid=31422 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105386.591:632): user pid=31422 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.592:633): user pid=31425 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31425 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.592:634): user pid=31425 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31425 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105386.593:635): user pid=31425 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105386.916:636): user pid=31422 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105386.916:637): user pid=31422 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105386.919:638): user pid=31422 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105386.919:639): user pid=31422 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.919:640): user pid=31422 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31422 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.919:641): user pid=31422 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31422 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.919:642): user pid=31422 uid=0 auid=0 ses=74 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31422 suid=0 rport=50950 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.951:643): user pid=31434 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31434 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105386.951:644): user pid=31434 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31434 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105386.951:645): user pid=31433 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31434 suid=74 rport=50951 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105386.952:646): user pid=31433 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31434 suid=74 rport=50951 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105387.012:647): user pid=31433 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=50951 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105387.012:648): user pid=31433 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=50951 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105387.020:649): user pid=31433 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105387.020:650): user pid=31433 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31434 suid=74 rport=50951 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105387.021:651): user pid=31433 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105387.022:652): user pid=31433 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105387.022:653): pid=31433 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=75
>type=USER_ROLE_CHANGE msg=audit(1406105387.094:654): user pid=31433 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105387.104:655): user pid=31433 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105387.106:656): user pid=31433 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105387.107:657): user pid=31433 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105387.108:658): user pid=31436 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31436 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105387.108:659): user pid=31436 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31436 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105387.109:660): user pid=31436 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105394.236:661): user pid=31433 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105394.237:662): user pid=31433 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105394.239:663): user pid=31433 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105394.239:664): user pid=31433 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105394.240:665): user pid=31433 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31433 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105394.240:666): user pid=31433 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31433 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105394.240:667): user pid=31433 uid=0 auid=0 ses=75 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31433 suid=0 rport=50951 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105401.029:668): user pid=31446 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406105401.029:669): user pid=31446 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406105401.036:670): pid=31446 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=76
>type=USER_START msg=audit(1406105401.043:671): user pid=31446 uid=0 auid=0 ses=76 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406105401.129:672): user pid=31446 uid=0 auid=0 ses=76 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406105401.129:673): user pid=31446 uid=0 auid=0 ses=76 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105417.891:674): user pid=31450 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31450 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105417.891:675): user pid=31450 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31450 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105417.891:676): user pid=31449 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31450 suid=74 rport=50999 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105417.891:677): user pid=31449 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31450 suid=74 rport=50999 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105417.897:678): user pid=31449 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31450 suid=74 rport=50999 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105417.898:679): user pid=31449 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31449 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105417.898:680): user pid=31449 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31449 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_LOGIN msg=audit(1406105417.898:681): user pid=31449 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct=28756E6B6E6F776E207573657229 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=failed'
>type=CRYPTO_KEY_USER msg=audit(1406105418.366:682): user pid=31452 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31452 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.366:683): user pid=31452 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31452 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105418.367:684): user pid=31451 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31452 suid=74 rport=51002 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105418.367:685): user pid=31451 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31452 suid=74 rport=51002 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105418.428:686): user pid=31451 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51002 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105418.428:687): user pid=31451 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51002 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105418.435:688): user pid=31451 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.435:689): user pid=31451 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31452 suid=74 rport=51002 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105418.436:690): user pid=31451 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105418.437:691): user pid=31451 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105418.437:692): pid=31451 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=77
>type=USER_ROLE_CHANGE msg=audit(1406105418.509:693): user pid=31451 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105418.518:694): user pid=31451 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105418.521:695): user pid=31451 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105418.521:696): user pid=31451 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.522:697): user pid=31454 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31454 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.522:698): user pid=31454 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31454 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105418.523:699): user pid=31454 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105418.576:700): user pid=31451 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105418.577:701): user pid=31451 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105418.578:702): user pid=31451 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105418.579:703): user pid=31451 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.579:704): user pid=31451 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31451 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.579:705): user pid=31451 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31451 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.579:706): user pid=31451 uid=0 auid=0 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31451 suid=0 rport=51002 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.593:707): user pid=31463 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31463 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.593:708): user pid=31463 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31463 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105418.593:709): user pid=31462 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31463 suid=74 rport=51003 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105418.593:710): user pid=31462 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31463 suid=74 rport=51003 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105418.653:711): user pid=31462 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51003 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105418.654:712): user pid=31462 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51003 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105418.660:713): user pid=31462 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.662:714): user pid=31462 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31463 suid=74 rport=51003 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105418.662:715): user pid=31462 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105418.663:716): user pid=31462 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105418.663:717): pid=31462 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=78
>type=USER_ROLE_CHANGE msg=audit(1406105418.735:718): user pid=31462 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105418.745:719): user pid=31462 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105418.746:720): user pid=31462 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105418.746:721): user pid=31462 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.746:722): user pid=31465 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31465 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.747:723): user pid=31465 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31465 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105418.748:724): user pid=31465 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105418.795:725): user pid=31462 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105418.795:726): user pid=31462 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105418.796:727): user pid=31462 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105418.797:728): user pid=31462 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.797:729): user pid=31462 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31462 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.797:730): user pid=31462 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31462 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105418.797:731): user pid=31462 uid=0 auid=0 ses=78 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31462 suid=0 rport=51003 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105475.209:732): user pid=31475 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31475 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105475.210:733): user pid=31475 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31475 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105475.210:734): user pid=31474 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31475 suid=74 rport=51031 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105475.210:735): user pid=31474 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31475 suid=74 rport=51031 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105475.276:736): user pid=31474 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51031 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105475.276:737): user pid=31474 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51031 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105475.283:738): user pid=31474 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105475.283:739): user pid=31474 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31475 suid=74 rport=51031 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105475.284:740): user pid=31474 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105475.284:741): user pid=31474 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105475.284:742): pid=31474 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=79
>type=USER_ROLE_CHANGE msg=audit(1406105475.354:743): user pid=31474 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105475.364:744): user pid=31474 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105475.366:745): user pid=31474 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105475.366:746): user pid=31474 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105475.366:747): user pid=31477 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31477 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105475.366:748): user pid=31477 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31477 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105475.368:749): user pid=31477 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=ADD_GROUP msg=audit(1406105499.887:750): user pid=31491 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=52 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406105499.971:751): user pid=31491 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=52 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406105499.971:752): user pid=31491 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=52 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1406105500.055:753): user pid=31496 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=52 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406105505.029:754): user pid=31474 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105505.030:755): user pid=31474 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105505.031:756): user pid=31474 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105505.032:757): user pid=31474 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105505.032:758): user pid=31474 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31474 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105505.032:759): user pid=31474 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31474 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105505.032:760): user pid=31474 uid=0 auid=0 ses=79 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31474 suid=0 rport=51031 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.201:761): user pid=31508 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31508 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.201:762): user pid=31508 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31508 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105506.201:763): user pid=31507 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31508 suid=74 rport=51036 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105506.202:764): user pid=31507 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31508 suid=74 rport=51036 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105506.270:765): user pid=31507 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51036 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105506.270:766): user pid=31507 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51036 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105506.276:767): user pid=31507 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.278:768): user pid=31507 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31508 suid=74 rport=51036 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105506.279:769): user pid=31507 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105506.279:770): user pid=31507 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105506.279:771): pid=31507 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=80
>type=USER_ROLE_CHANGE msg=audit(1406105506.355:772): user pid=31507 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105506.366:773): user pid=31507 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105506.368:774): user pid=31507 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105506.369:775): user pid=31507 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.370:776): user pid=31510 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31510 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.370:777): user pid=31510 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31510 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105506.371:778): user pid=31510 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105506.419:779): user pid=31507 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105506.419:780): user pid=31507 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105506.420:781): user pid=31507 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105506.421:782): user pid=31507 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.421:783): user pid=31507 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31507 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.421:784): user pid=31507 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31507 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.421:785): user pid=31507 uid=0 auid=0 ses=80 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31507 suid=0 rport=51036 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.433:786): user pid=31520 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31520 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.433:787): user pid=31520 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31520 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105506.434:788): user pid=31519 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31520 suid=74 rport=51037 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105506.434:789): user pid=31519 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31520 suid=74 rport=51037 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105506.492:790): user pid=31519 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51037 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105506.492:791): user pid=31519 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51037 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105506.499:792): user pid=31519 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.499:793): user pid=31519 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31520 suid=74 rport=51037 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105506.500:794): user pid=31519 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105506.501:795): user pid=31519 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105506.501:796): pid=31519 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=81
>type=USER_ROLE_CHANGE msg=audit(1406105506.574:797): user pid=31519 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105506.586:798): user pid=31519 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105506.588:799): user pid=31519 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105506.589:800): user pid=31519 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.590:801): user pid=31522 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31522 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.590:802): user pid=31522 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31522 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105506.591:803): user pid=31522 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105506.734:804): user pid=31519 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105506.735:805): user pid=31519 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105506.736:806): user pid=31519 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105506.737:807): user pid=31519 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.737:808): user pid=31519 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31519 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.737:809): user pid=31519 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31519 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.737:810): user pid=31519 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31519 suid=0 rport=51037 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.977:811): user pid=31532 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31532 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105506.977:812): user pid=31532 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31532 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105506.977:813): user pid=31531 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31532 suid=74 rport=51039 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105506.977:814): user pid=31531 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31532 suid=74 rport=51039 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105507.038:815): user pid=31531 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51039 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105507.038:816): user pid=31531 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51039 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105507.044:817): user pid=31531 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105507.045:818): user pid=31531 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31532 suid=74 rport=51039 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105507.045:819): user pid=31531 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105507.046:820): user pid=31531 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105507.046:821): pid=31531 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=82
>type=USER_ROLE_CHANGE msg=audit(1406105507.118:822): user pid=31531 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105507.126:823): user pid=31531 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105507.128:824): user pid=31531 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105507.129:825): user pid=31531 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105507.130:826): user pid=31534 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31534 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105507.130:827): user pid=31534 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31534 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105507.131:828): user pid=31534 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105507.188:829): user pid=31531 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105507.188:830): user pid=31531 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105507.189:831): user pid=31531 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105507.189:832): user pid=31531 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105507.190:833): user pid=31531 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31531 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105507.190:834): user pid=31531 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31531 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105507.190:835): user pid=31531 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31531 suid=0 rport=51039 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105510.689:836): user pid=31841 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31841 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105510.689:837): user pid=31841 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31841 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105510.689:838): user pid=31840 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31841 suid=74 rport=51042 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105510.689:839): user pid=31840 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31841 suid=74 rport=51042 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105510.744:840): user pid=31840 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51042 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105510.744:841): user pid=31840 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51042 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105510.749:842): user pid=31840 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105510.749:843): user pid=31840 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31841 suid=74 rport=51042 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105510.750:844): user pid=31840 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105510.750:845): user pid=31840 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105510.750:846): pid=31840 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=83
>type=USER_ROLE_CHANGE msg=audit(1406105510.824:847): user pid=31840 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105510.838:848): user pid=31840 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105510.840:849): user pid=31840 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105510.841:850): user pid=31840 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105510.841:851): user pid=31843 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31843 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105510.841:852): user pid=31843 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31843 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105510.842:853): user pid=31843 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105510.870:854): user pid=31840 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105510.870:855): user pid=31840 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105510.871:856): user pid=31840 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105510.871:857): user pid=31840 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105510.872:858): user pid=31840 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31840 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105510.872:859): user pid=31840 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31840 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105510.872:860): user pid=31840 uid=0 auid=0 ses=83 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31840 suid=0 rport=51042 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105520.303:861): user pid=31858 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31858 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105520.303:862): user pid=31858 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31858 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105520.304:863): user pid=31857 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31858 suid=74 rport=51077 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105520.304:864): user pid=31857 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31858 suid=74 rport=51077 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105520.363:865): user pid=31857 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51077 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105520.364:866): user pid=31857 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51077 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105520.371:867): user pid=31857 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105520.371:868): user pid=31857 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31858 suid=74 rport=51077 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105520.372:869): user pid=31857 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105520.373:870): user pid=31857 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105520.373:871): pid=31857 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=84
>type=USER_ROLE_CHANGE msg=audit(1406105520.446:872): user pid=31857 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105520.455:873): user pid=31857 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105520.456:874): user pid=31857 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105520.456:875): user pid=31857 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105520.457:876): user pid=31860 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31860 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105520.457:877): user pid=31860 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31860 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105520.458:878): user pid=31860 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105520.498:879): user pid=31857 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105520.499:880): user pid=31857 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105520.499:881): user pid=31857 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105520.500:882): user pid=31857 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105520.500:883): user pid=31857 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31857 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105520.500:884): user pid=31857 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31857 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105520.500:885): user pid=31857 uid=0 auid=0 ses=84 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31857 suid=0 rport=51077 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=ADD_GROUP msg=audit(1406105520.860:886): user pid=31869 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=499 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406105520.919:887): user pid=31869 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=499 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406105520.919:888): user pid=31869 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=499 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105529.977:889): user pid=31882 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31882 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105529.977:890): user pid=31882 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31882 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105529.978:891): user pid=31881 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31882 suid=74 rport=51080 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105529.978:892): user pid=31881 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31882 suid=74 rport=51080 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105530.032:893): user pid=31881 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51080 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105530.032:894): user pid=31881 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51080 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105530.036:895): user pid=31881 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105530.037:896): user pid=31881 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31882 suid=74 rport=51080 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105530.037:897): user pid=31881 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105530.038:898): user pid=31881 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105530.038:899): pid=31881 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=85
>type=USER_ROLE_CHANGE msg=audit(1406105530.105:900): user pid=31881 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105530.116:901): user pid=31881 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105530.119:902): user pid=31881 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105530.119:903): user pid=31881 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105530.119:904): user pid=31884 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31884 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105530.120:905): user pid=31884 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31884 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105530.120:906): user pid=31884 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105530.150:907): user pid=31881 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105530.150:908): user pid=31881 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105530.151:909): user pid=31881 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105530.151:910): user pid=31881 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105530.151:911): user pid=31881 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31881 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105530.151:912): user pid=31881 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31881 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105530.151:913): user pid=31881 uid=0 auid=0 ses=85 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31881 suid=0 rport=51080 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105539.560:914): user pid=31896 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31896 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105539.560:915): user pid=31896 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31896 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105539.560:916): user pid=31895 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31896 suid=74 rport=51083 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105539.560:917): user pid=31895 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31896 suid=74 rport=51083 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105539.614:918): user pid=31895 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51083 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105539.614:919): user pid=31895 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51083 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105539.620:920): user pid=31895 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105539.620:921): user pid=31895 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31896 suid=74 rport=51083 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105539.620:922): user pid=31895 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105539.621:923): user pid=31895 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105539.621:924): pid=31895 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=86
>type=USER_ROLE_CHANGE msg=audit(1406105539.698:925): user pid=31895 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105539.709:926): user pid=31895 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105539.711:927): user pid=31895 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105539.711:928): user pid=31895 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105539.712:929): user pid=31898 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31898 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105539.712:930): user pid=31898 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31898 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105539.713:931): user pid=31898 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105539.748:932): user pid=31895 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105539.748:933): user pid=31895 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105539.749:934): user pid=31895 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105539.749:935): user pid=31895 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105539.749:936): user pid=31895 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31895 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105539.749:937): user pid=31895 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31895 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105539.750:938): user pid=31895 uid=0 auid=0 ses=86 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31895 suid=0 rport=51083 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105549.176:939): user pid=31906 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31906 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105549.176:940): user pid=31906 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31906 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105549.176:941): user pid=31905 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31906 suid=74 rport=51086 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105549.176:942): user pid=31905 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31906 suid=74 rport=51086 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105549.230:943): user pid=31905 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51086 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105549.230:944): user pid=31905 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51086 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105549.234:945): user pid=31905 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105549.234:946): user pid=31905 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31906 suid=74 rport=51086 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105549.235:947): user pid=31905 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105549.235:948): user pid=31905 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105549.235:949): pid=31905 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=87
>type=USER_ROLE_CHANGE msg=audit(1406105549.303:950): user pid=31905 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105549.315:951): user pid=31905 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105549.317:952): user pid=31905 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105549.318:953): user pid=31905 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105549.318:954): user pid=31908 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31908 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105549.318:955): user pid=31908 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31908 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105549.319:956): user pid=31908 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105549.357:957): user pid=31905 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105549.358:958): user pid=31905 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105549.359:959): user pid=31905 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105549.360:960): user pid=31905 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105549.360:961): user pid=31905 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31905 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105549.360:962): user pid=31905 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31905 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105549.360:963): user pid=31905 uid=0 auid=0 ses=87 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31905 suid=0 rport=51086 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105558.781:964): user pid=31918 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31918 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105558.781:965): user pid=31918 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31918 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105558.781:966): user pid=31917 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31918 suid=74 rport=51089 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105558.782:967): user pid=31917 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31918 suid=74 rport=51089 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105558.835:968): user pid=31917 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51089 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105558.835:969): user pid=31917 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51089 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105558.839:970): user pid=31917 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105558.839:971): user pid=31917 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31918 suid=74 rport=51089 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105558.839:972): user pid=31917 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105558.840:973): user pid=31917 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105558.840:974): pid=31917 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=88
>type=USER_ROLE_CHANGE msg=audit(1406105558.905:975): user pid=31917 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105558.915:976): user pid=31917 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105558.917:977): user pid=31917 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105558.918:978): user pid=31917 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105558.918:979): user pid=31920 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31920 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105558.918:980): user pid=31920 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31920 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105558.919:981): user pid=31920 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105558.947:982): user pid=31917 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105558.947:983): user pid=31917 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105558.948:984): user pid=31917 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105558.948:985): user pid=31917 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105558.948:986): user pid=31917 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31917 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105558.948:987): user pid=31917 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31917 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105558.949:988): user pid=31917 uid=0 auid=0 ses=88 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31917 suid=0 rport=51089 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105568.344:989): user pid=31928 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31928 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105568.344:990): user pid=31928 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31928 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105568.344:991): user pid=31927 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31928 suid=74 rport=51092 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105568.344:992): user pid=31927 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31928 suid=74 rport=51092 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105568.397:993): user pid=31927 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51092 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105568.397:994): user pid=31927 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51092 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105568.401:995): user pid=31927 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105568.401:996): user pid=31927 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31928 suid=74 rport=51092 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105568.402:997): user pid=31927 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105568.402:998): user pid=31927 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105568.402:999): pid=31927 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=89
>type=USER_ROLE_CHANGE msg=audit(1406105568.467:1000): user pid=31927 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105568.478:1001): user pid=31927 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105568.480:1002): user pid=31927 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105568.481:1003): user pid=31927 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105568.481:1004): user pid=31930 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31930 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105568.481:1005): user pid=31930 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31930 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105568.482:1006): user pid=31930 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105568.511:1007): user pid=31927 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105568.511:1008): user pid=31927 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105568.512:1009): user pid=31927 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105568.512:1010): user pid=31927 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105568.512:1011): user pid=31927 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31927 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105568.512:1012): user pid=31927 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31927 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105568.512:1013): user pid=31927 uid=0 auid=0 ses=89 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31927 suid=0 rport=51092 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=MAC_POLICY_LOAD msg=audit(1406105572.388:1014): policy loaded auid=0 ses=82
>type=SYSCALL msg=audit(1406105572.388:1014): arch=c000003e syscall=1 success=yes exit=7322487 a0=4 a1=7f69ba2ac000 a2=6fbb77 a3=7fff43a582b0 items=0 ppid=31915 pid=31939 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=82 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=MAC_POLICY_LOAD msg=audit(1406105576.824:1015): policy loaded auid=0 ses=82
>type=SYSCALL msg=audit(1406105576.824:1015): arch=c000003e syscall=1 success=yes exit=7322487 a0=4 a1=7f8f542a6000 a2=6fbb77 a3=7fff438db800 items=0 ppid=31940 pid=31941 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=82 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=CRYPTO_KEY_USER msg=audit(1406105578.146:1016): user pid=31944 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31944 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105578.146:1017): user pid=31944 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31944 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105578.147:1018): user pid=31943 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31944 suid=74 rport=51095 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105578.147:1019): user pid=31943 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31944 suid=74 rport=51095 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105578.204:1020): user pid=31943 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51095 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105578.204:1021): user pid=31943 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51095 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105578.209:1022): user pid=31943 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105578.210:1023): user pid=31943 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31944 suid=74 rport=51095 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105578.210:1024): user pid=31943 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105578.211:1025): user pid=31943 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105578.211:1026): pid=31943 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=90
>type=USER_ROLE_CHANGE msg=audit(1406105578.285:1027): user pid=31943 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105578.297:1028): user pid=31943 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105578.299:1029): user pid=31943 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105578.299:1030): user pid=31943 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105578.300:1031): user pid=31947 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31947 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105578.300:1032): user pid=31947 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31947 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105578.302:1033): user pid=31947 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105578.332:1034): user pid=31943 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105578.332:1035): user pid=31943 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105578.333:1036): user pid=31943 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105578.333:1037): user pid=31943 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105578.333:1038): user pid=31943 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31943 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105578.333:1039): user pid=31943 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31943 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105578.334:1040): user pid=31943 uid=0 auid=0 ses=90 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31943 suid=0 rport=51095 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=MAC_POLICY_LOAD msg=audit(1406105581.714:1041): policy loaded auid=0 ses=82
>type=SYSCALL msg=audit(1406105581.714:1041): arch=c000003e syscall=1 success=yes exit=7322487 a0=4 a1=7fc1a4568000 a2=6fbb77 a3=7fffbe017d30 items=0 ppid=31945 pid=31954 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=82 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=MAC_POLICY_LOAD msg=audit(1406105586.600:1042): policy loaded auid=0 ses=82
>type=SYSCALL msg=audit(1406105586.600:1042): arch=c000003e syscall=1 success=yes exit=7322487 a0=4 a1=7f18e92c1000 a2=6fbb77 a3=7fffacff94c0 items=0 ppid=31956 pid=31957 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=82 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
>type=CRYPTO_KEY_USER msg=audit(1406105587.826:1043): user pid=31960 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31960 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105587.826:1044): user pid=31960 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31960 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105587.827:1045): user pid=31959 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31960 suid=74 rport=51098 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105587.827:1046): user pid=31959 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31960 suid=74 rport=51098 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105587.884:1047): user pid=31959 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51098 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105587.884:1048): user pid=31959 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51098 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105587.891:1049): user pid=31959 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105587.891:1050): user pid=31959 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31960 suid=74 rport=51098 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105587.892:1051): user pid=31959 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105587.892:1052): user pid=31959 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105587.893:1053): pid=31959 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=91
>type=USER_ROLE_CHANGE msg=audit(1406105587.976:1054): user pid=31959 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105587.984:1055): user pid=31959 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105587.986:1056): user pid=31959 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105587.987:1057): user pid=31959 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105587.987:1058): user pid=31963 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31963 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105587.987:1059): user pid=31963 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31963 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105587.989:1060): user pid=31963 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105588.022:1061): user pid=31959 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105588.022:1062): user pid=31959 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105588.023:1063): user pid=31959 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105588.023:1064): user pid=31959 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105588.024:1065): user pid=31959 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31959 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105588.024:1066): user pid=31959 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31959 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105588.024:1067): user pid=31959 uid=0 auid=0 ses=91 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31959 suid=0 rport=51098 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105597.459:1068): user pid=31971 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31971 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105597.459:1069): user pid=31971 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31971 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105597.459:1070): user pid=31970 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31971 suid=74 rport=51101 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105597.459:1071): user pid=31970 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31971 suid=74 rport=51101 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105597.512:1072): user pid=31970 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51101 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105597.512:1073): user pid=31970 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51101 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105597.517:1074): user pid=31970 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105597.518:1075): user pid=31970 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31971 suid=74 rport=51101 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105597.518:1076): user pid=31970 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105597.518:1077): user pid=31970 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105597.518:1078): pid=31970 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=92
>type=USER_ROLE_CHANGE msg=audit(1406105597.582:1079): user pid=31970 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105597.594:1080): user pid=31970 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105597.596:1081): user pid=31970 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105597.597:1082): user pid=31970 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105597.597:1083): user pid=31973 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31973 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105597.597:1084): user pid=31973 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31973 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105597.598:1085): user pid=31973 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105597.628:1086): user pid=31970 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105597.629:1087): user pid=31970 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105597.629:1088): user pid=31970 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105597.630:1089): user pid=31970 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105597.630:1090): user pid=31970 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31970 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105597.630:1091): user pid=31970 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31970 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105597.630:1092): user pid=31970 uid=0 auid=0 ses=92 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31970 suid=0 rport=51101 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=MAC_CONFIG_CHANGE msg=audit(1406105605.345:1093): bool=virt_use_fusefs val=1 old_val=0 auid=0 ses=82
>type=SYSCALL msg=audit(1406105605.345:1093): arch=c000003e syscall=1 success=yes exit=2 a0=4 a1=7ffffec4b0a0 a2=2 a3=0 items=0 ppid=31915 pid=31962 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=82 comm="setsebool" exe="/usr/sbin/setsebool" subj=unconfined_u:system_r:setsebool_t:s0-s0:c0.c1023 key=(null)
>type=CRYPTO_KEY_USER msg=audit(1406105607.044:1094): user pid=31983 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31983 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105607.044:1095): user pid=31983 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31983 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105607.045:1096): user pid=31982 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=31983 suid=74 rport=51105 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105607.045:1097): user pid=31982 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=31983 suid=74 rport=51105 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105607.100:1098): user pid=31982 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51105 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105607.100:1099): user pid=31982 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51105 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105607.105:1100): user pid=31982 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105607.105:1101): user pid=31982 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31983 suid=74 rport=51105 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105607.105:1102): user pid=31982 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105607.106:1103): user pid=31982 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105607.106:1104): pid=31982 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=93
>type=USER_ROLE_CHANGE msg=audit(1406105607.181:1105): user pid=31982 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105607.190:1106): user pid=31982 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105607.191:1107): user pid=31982 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105607.191:1108): user pid=31982 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105607.192:1109): user pid=31985 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31985 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105607.192:1110): user pid=31985 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31985 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105607.193:1111): user pid=31985 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105607.223:1112): user pid=31982 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105607.223:1113): user pid=31982 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105607.224:1114): user pid=31982 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105607.224:1115): user pid=31982 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105607.224:1116): user pid=31982 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=31982 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105607.224:1117): user pid=31982 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=31982 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105607.224:1118): user pid=31982 uid=0 auid=0 ses=93 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=31982 suid=0 rport=51105 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105613.761:1119): user pid=32050 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32050 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105613.762:1120): user pid=32050 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32050 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105613.762:1121): user pid=32049 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32050 suid=74 rport=51119 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406105613.762:1122): user pid=32049 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32050 suid=74 rport=51119 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105613.824:1123): user pid=32049 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51119 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105613.824:1124): user pid=32049 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51119 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406105613.830:1125): user pid=32049 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105613.831:1126): user pid=32049 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32050 suid=74 rport=51119 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406105613.831:1127): user pid=32049 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406105613.832:1128): user pid=32049 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406105613.832:1129): pid=32049 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=94
>type=USER_ROLE_CHANGE msg=audit(1406105613.908:1130): user pid=32049 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105613.918:1131): user pid=32049 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406105613.919:1132): user pid=32049 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406105613.920:1133): user pid=32049 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105613.921:1134): user pid=32052 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32052 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105613.921:1135): user pid=32052 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32052 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406105613.922:1136): user pid=32052 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105613.964:1137): user pid=32049 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406105613.965:1138): user pid=32049 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406105613.967:1139): user pid=32049 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406105613.967:1140): user pid=32049 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105613.967:1141): user pid=32049 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32049 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105613.967:1142): user pid=32049 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32049 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406105613.968:1143): user pid=32049 uid=0 auid=0 ses=94 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32049 suid=0 rport=51119 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106001.173:1144): user pid=32059 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406106001.173:1145): user pid=32059 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406106001.180:1146): pid=32059 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=95
>type=USER_START msg=audit(1406106001.187:1147): user pid=32059 uid=0 auid=0 ses=95 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406106001.283:1148): user pid=32059 uid=0 auid=0 ses=95 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406106001.284:1149): user pid=32059 uid=0 auid=0 ses=95 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106022.638:1150): user pid=32064 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32064 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106022.638:1151): user pid=32064 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32064 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106022.639:1152): user pid=32063 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32064 suid=74 rport=51821 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106022.639:1153): user pid=32063 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32064 suid=74 rport=51821 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106022.697:1154): user pid=32063 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51821 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106022.697:1155): user pid=32063 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51821 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106022.705:1156): user pid=32063 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106022.705:1157): user pid=32063 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32064 suid=74 rport=51821 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106022.706:1158): user pid=32063 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106022.707:1159): user pid=32063 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106022.707:1160): pid=32063 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=96
>type=USER_ROLE_CHANGE msg=audit(1406106022.776:1161): user pid=32063 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106022.787:1162): user pid=32063 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106022.789:1163): user pid=32063 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106022.791:1164): user pid=32063 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106022.792:1165): user pid=32066 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32066 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106022.792:1166): user pid=32066 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32066 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106022.793:1167): user pid=32066 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106022.846:1168): user pid=32063 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106022.847:1169): user pid=32063 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106022.852:1170): user pid=32063 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106022.854:1171): user pid=32063 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106022.854:1172): user pid=32063 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32063 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106022.854:1173): user pid=32063 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32063 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106022.854:1174): user pid=32063 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32063 suid=0 rport=51821 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106034.968:1175): user pid=32375 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32375 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106034.968:1176): user pid=32375 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32375 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106034.969:1177): user pid=32374 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32375 suid=74 rport=51851 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106034.969:1178): user pid=32374 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32375 suid=74 rport=51851 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106035.026:1179): user pid=32374 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51851 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106035.026:1180): user pid=32374 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51851 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106035.033:1181): user pid=32374 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106035.034:1182): user pid=32374 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32375 suid=74 rport=51851 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106035.034:1183): user pid=32374 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106035.035:1184): user pid=32374 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106035.035:1185): pid=32374 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=97
>type=USER_ROLE_CHANGE msg=audit(1406106035.110:1186): user pid=32374 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106035.121:1187): user pid=32374 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106035.123:1188): user pid=32374 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106035.124:1189): user pid=32374 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106035.125:1190): user pid=32377 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32377 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106035.125:1191): user pid=32377 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32377 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106035.127:1192): user pid=32377 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106035.173:1193): user pid=32374 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106035.174:1194): user pid=32374 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106035.176:1195): user pid=32374 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106035.177:1196): user pid=32374 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106035.177:1197): user pid=32374 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32374 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106035.177:1198): user pid=32374 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32374 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106035.177:1199): user pid=32374 uid=0 auid=0 ses=97 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32374 suid=0 rport=51851 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106051.139:1200): user pid=32395 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32395 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106051.140:1201): user pid=32395 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32395 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106051.140:1202): user pid=32394 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32395 suid=74 rport=51894 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106051.140:1203): user pid=32394 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32395 suid=74 rport=51894 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106051.205:1204): user pid=32394 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51894 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106051.205:1205): user pid=32394 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51894 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106051.211:1206): user pid=32394 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106051.212:1207): user pid=32394 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32395 suid=74 rport=51894 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106051.212:1208): user pid=32394 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106051.213:1209): user pid=32394 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106051.214:1210): pid=32394 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=98
>type=USER_ROLE_CHANGE msg=audit(1406106051.288:1211): user pid=32394 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106051.298:1212): user pid=32394 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106051.302:1213): user pid=32394 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106051.303:1214): user pid=32394 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106051.304:1215): user pid=32397 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32397 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106051.304:1216): user pid=32397 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32397 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106051.305:1217): user pid=32397 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106051.336:1218): user pid=32394 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106051.337:1219): user pid=32394 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106051.338:1220): user pid=32394 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106051.338:1221): user pid=32394 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106051.338:1222): user pid=32394 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32394 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106051.338:1223): user pid=32394 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32394 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106051.338:1224): user pid=32394 uid=0 auid=0 ses=98 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32394 suid=0 rport=51894 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106054.637:1225): user pid=32411 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=36 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106054.704:1226): user pid=32411 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=36 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106054.704:1227): user pid=32411 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=36 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106054.771:1228): user pid=32416 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=107 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106054.838:1229): user pid=32416 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=107 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106054.838:1230): user pid=32416 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=107 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1406106054.907:1231): user pid=32421 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=107 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1406106054.907:1232): user pid=32421 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to group acct="qemu" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1406106054.907:1233): user pid=32421 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to shadow group acct="qemu" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406106058.855:1234): table=filter family=2 entries=0
>type=SYSCALL msg=audit(1406106058.855:1234): arch=c000003e syscall=175 success=yes exit=0 a0=ecb2e0 a1=22a0 a2=ec34e0 a3=7fffbd5ff790 items=0 ppid=32443 pid=32444 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/sbin/modprobe" subj=system_u:system_r:insmod_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1406106058.858:1235): table=filter family=2 entries=4
>type=SYSCALL msg=audit(1406106058.858:1235): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=21c42c0 items=0 ppid=32077 pid=32439 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_ACCT msg=audit(1406106061.303:1236): user pid=32479 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406106061.303:1237): user pid=32479 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406106061.308:1238): pid=32479 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=99
>type=USER_START msg=audit(1406106061.316:1239): user pid=32479 uid=0 auid=0 ses=99 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406106061.343:1240): user pid=32479 uid=0 auid=0 ses=99 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406106061.343:1241): user pid=32479 uid=0 auid=0 ses=99 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106067.319:1242): user pid=32494 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32494 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106067.319:1243): user pid=32494 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32494 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106067.320:1244): user pid=32492 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32494 suid=74 rport=51938 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106067.320:1245): user pid=32492 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32494 suid=74 rport=51938 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106067.377:1246): user pid=32492 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51938 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106067.377:1247): user pid=32492 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51938 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106067.389:1248): user pid=32492 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106067.390:1249): user pid=32492 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32494 suid=74 rport=51938 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106067.390:1250): user pid=32492 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106067.391:1251): user pid=32492 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106067.392:1252): pid=32492 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=100
>type=USER_ROLE_CHANGE msg=audit(1406106067.472:1253): user pid=32492 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106067.482:1254): user pid=32492 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106067.485:1255): user pid=32492 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106067.485:1256): user pid=32492 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106067.486:1257): user pid=32498 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32498 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106067.486:1258): user pid=32498 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32498 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106067.487:1259): user pid=32498 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106067.518:1260): user pid=32492 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106067.525:1261): user pid=32492 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106067.526:1262): user pid=32492 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106067.528:1263): user pid=32492 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106067.528:1264): user pid=32492 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32492 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106067.528:1265): user pid=32492 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32492 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106067.528:1266): user pid=32492 uid=0 auid=0 ses=100 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32492 suid=0 rport=51938 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106083.501:1267): user pid=32509 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32509 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106083.501:1268): user pid=32509 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32509 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106083.502:1269): user pid=32508 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32509 suid=74 rport=51975 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106083.502:1270): user pid=32508 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32509 suid=74 rport=51975 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106083.556:1271): user pid=32508 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51975 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106083.556:1272): user pid=32508 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=51975 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106083.563:1273): user pid=32508 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106083.563:1274): user pid=32508 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32509 suid=74 rport=51975 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106083.564:1275): user pid=32508 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106083.565:1276): user pid=32508 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106083.565:1277): pid=32508 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=101
>type=USER_ROLE_CHANGE msg=audit(1406106083.638:1278): user pid=32508 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106083.654:1279): user pid=32508 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106083.656:1280): user pid=32508 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106083.657:1281): user pid=32508 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106083.658:1282): user pid=32511 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32511 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106083.659:1283): user pid=32511 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32511 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106083.660:1284): user pid=32511 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106083.707:1285): user pid=32508 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106083.707:1286): user pid=32508 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106083.708:1287): user pid=32508 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106083.709:1288): user pid=32508 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106083.709:1289): user pid=32508 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32508 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106083.709:1290): user pid=32508 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32508 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106083.709:1291): user pid=32508 uid=0 auid=0 ses=101 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32508 suid=0 rport=51975 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406106090.712:1292): table=filter family=2 entries=5
>type=SYSCALL msg=audit(1406106090.712:1292): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1f749b0 items=0 ppid=32077 pid=32522 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106091.059:1293): table=filter family=2 entries=6
>type=SYSCALL msg=audit(1406106091.059:1293): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1c7be10 items=0 ppid=32077 pid=32555 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=CRYPTO_KEY_USER msg=audit(1406106099.739:1294): user pid=32588 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32588 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106099.739:1295): user pid=32588 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32588 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106099.741:1296): user pid=32587 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32588 suid=74 rport=52002 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106099.742:1297): user pid=32587 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32588 suid=74 rport=52002 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106099.804:1298): user pid=32587 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52002 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106099.804:1299): user pid=32587 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52002 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106099.814:1300): user pid=32587 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106099.815:1301): user pid=32587 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32588 suid=74 rport=52002 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106099.815:1302): user pid=32587 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106099.817:1303): user pid=32587 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106099.817:1304): pid=32587 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=102
>type=USER_ROLE_CHANGE msg=audit(1406106099.890:1305): user pid=32587 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106099.901:1306): user pid=32587 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106099.902:1307): user pid=32587 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106099.903:1308): user pid=32587 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106099.904:1309): user pid=32590 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32590 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106099.904:1310): user pid=32590 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32590 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106099.907:1311): user pid=32590 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106099.954:1312): user pid=32587 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106099.955:1313): user pid=32587 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106099.956:1314): user pid=32587 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106099.957:1315): user pid=32587 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106099.957:1316): user pid=32587 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32587 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106099.957:1317): user pid=32587 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32587 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106099.957:1318): user pid=32587 uid=0 auid=0 ses=102 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32587 suid=0 rport=52002 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106105.228:1319): user pid=32612 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=75 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106105.312:1320): user pid=32612 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=75 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106105.312:1321): user pid=32612 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=75 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1406106105.405:1322): user pid=32617 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=75 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106115.936:1323): user pid=32665 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32665 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106115.936:1324): user pid=32665 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32665 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106115.938:1325): user pid=32664 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32665 suid=74 rport=52044 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106115.938:1326): user pid=32664 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32665 suid=74 rport=52044 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106115.993:1327): user pid=32664 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52044 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106115.993:1328): user pid=32664 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52044 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106115.998:1329): user pid=32664 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106115.999:1330): user pid=32664 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32665 suid=74 rport=52044 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106115.999:1331): user pid=32664 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106116.000:1332): user pid=32664 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106116.000:1333): pid=32664 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=103
>type=USER_ROLE_CHANGE msg=audit(1406106116.073:1334): user pid=32664 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106116.084:1335): user pid=32664 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106116.086:1336): user pid=32664 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106116.086:1337): user pid=32664 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106116.087:1338): user pid=32667 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32667 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106116.087:1339): user pid=32667 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32667 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106116.088:1340): user pid=32667 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106116.118:1341): user pid=32664 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106116.118:1342): user pid=32664 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106116.119:1343): user pid=32664 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106116.120:1344): user pid=32664 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106116.120:1345): user pid=32664 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32664 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106116.120:1346): user pid=32664 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32664 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106116.120:1347): user pid=32664 uid=0 auid=0 ses=103 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32664 suid=0 rport=52044 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106132.108:1348): user pid=32678 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32678 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106132.108:1349): user pid=32678 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32678 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106132.110:1350): user pid=32677 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32678 suid=74 rport=52089 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106132.110:1351): user pid=32677 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32678 suid=74 rport=52089 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106132.170:1352): user pid=32677 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52089 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106132.170:1353): user pid=32677 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52089 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106132.177:1354): user pid=32677 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106132.177:1355): user pid=32677 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32678 suid=74 rport=52089 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106132.178:1356): user pid=32677 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106132.178:1357): user pid=32677 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106132.179:1358): pid=32677 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=104
>type=USER_ROLE_CHANGE msg=audit(1406106132.253:1359): user pid=32677 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106132.263:1360): user pid=32677 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106132.264:1361): user pid=32677 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106132.265:1362): user pid=32677 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106132.266:1363): user pid=32680 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32680 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106132.266:1364): user pid=32680 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32680 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106132.267:1365): user pid=32680 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106132.316:1366): user pid=32677 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106132.317:1367): user pid=32677 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106132.318:1368): user pid=32677 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106132.318:1369): user pid=32677 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106132.319:1370): user pid=32677 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32677 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106132.319:1371): user pid=32677 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32677 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106132.319:1372): user pid=32677 uid=0 auid=0 ses=104 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32677 suid=0 rport=52089 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106135.840:1373): user pid=32688 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32688 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106135.840:1374): user pid=32688 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32688 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106135.841:1375): user pid=32687 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32688 suid=74 rport=52092 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106135.841:1376): user pid=32687 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32688 suid=74 rport=52092 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106135.906:1377): user pid=32687 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52092 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106135.907:1378): user pid=32687 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52092 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106135.914:1379): user pid=32687 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106135.914:1380): user pid=32687 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32688 suid=74 rport=52092 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106135.915:1381): user pid=32687 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106135.916:1382): user pid=32687 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106135.916:1383): pid=32687 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=105
>type=USER_ROLE_CHANGE msg=audit(1406106135.986:1384): user pid=32687 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106135.997:1385): user pid=32687 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106135.998:1386): user pid=32687 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106135.998:1387): user pid=32687 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106135.999:1388): user pid=32690 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32690 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106135.999:1389): user pid=32690 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32690 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106136.000:1390): user pid=32690 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106136.045:1391): user pid=32687 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106136.046:1392): user pid=32687 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106136.046:1393): user pid=32687 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106136.047:1394): user pid=32687 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106136.047:1395): user pid=32687 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32687 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106136.047:1396): user pid=32687 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32687 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106136.047:1397): user pid=32687 uid=0 auid=0 ses=105 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32687 suid=0 rport=52092 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106145.478:1398): user pid=32698 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32698 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106145.479:1399): user pid=32698 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32698 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106145.479:1400): user pid=32697 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32698 suid=74 rport=52119 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106145.479:1401): user pid=32697 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32698 suid=74 rport=52119 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106145.534:1402): user pid=32697 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52119 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106145.535:1403): user pid=32697 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52119 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106145.541:1404): user pid=32697 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106145.541:1405): user pid=32697 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32698 suid=74 rport=52119 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106145.542:1406): user pid=32697 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106145.543:1407): user pid=32697 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106145.543:1408): pid=32697 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=106
>type=USER_ROLE_CHANGE msg=audit(1406106145.615:1409): user pid=32697 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106145.624:1410): user pid=32697 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106145.625:1411): user pid=32697 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106145.626:1412): user pid=32697 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106145.626:1413): user pid=32700 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32700 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106145.627:1414): user pid=32700 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32700 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106145.628:1415): user pid=32700 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106145.668:1416): user pid=32697 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106145.669:1417): user pid=32697 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106145.669:1418): user pid=32697 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106145.670:1419): user pid=32697 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106145.670:1420): user pid=32697 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32697 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106145.670:1421): user pid=32697 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32697 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106145.670:1422): user pid=32697 uid=0 auid=0 ses=106 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32697 suid=0 rport=52119 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106155.180:1423): user pid=32709 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32709 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106155.180:1424): user pid=32709 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32709 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106155.180:1425): user pid=32708 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32709 suid=74 rport=52147 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106155.180:1426): user pid=32708 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32709 suid=74 rport=52147 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106155.235:1427): user pid=32708 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52147 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106155.235:1428): user pid=32708 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52147 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106155.242:1429): user pid=32708 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106155.242:1430): user pid=32708 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32709 suid=74 rport=52147 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106155.243:1431): user pid=32708 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106155.243:1432): user pid=32708 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106155.243:1433): pid=32708 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=107
>type=USER_ROLE_CHANGE msg=audit(1406106155.318:1434): user pid=32708 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106155.330:1435): user pid=32708 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106155.334:1436): user pid=32708 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106155.334:1437): user pid=32708 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106155.335:1438): user pid=32711 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32711 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106155.335:1439): user pid=32711 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32711 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106155.336:1440): user pid=32711 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106155.368:1441): user pid=32708 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106155.369:1442): user pid=32708 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106155.370:1443): user pid=32708 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106155.370:1444): user pid=32708 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106155.371:1445): user pid=32708 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32708 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106155.371:1446): user pid=32708 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32708 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106155.371:1447): user pid=32708 uid=0 auid=0 ses=107 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32708 suid=0 rport=52147 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106164.888:1448): user pid=32719 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32719 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106164.888:1449): user pid=32719 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32719 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106164.889:1450): user pid=32718 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32719 suid=74 rport=52169 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106164.889:1451): user pid=32718 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32719 suid=74 rport=52169 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106164.944:1452): user pid=32718 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52169 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106164.944:1453): user pid=32718 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52169 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106164.950:1454): user pid=32718 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106164.951:1455): user pid=32718 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32719 suid=74 rport=52169 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106164.951:1456): user pid=32718 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106164.952:1457): user pid=32718 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106164.952:1458): pid=32718 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=108
>type=USER_ROLE_CHANGE msg=audit(1406106165.028:1459): user pid=32718 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106165.041:1460): user pid=32718 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106165.043:1461): user pid=32718 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106165.044:1462): user pid=32718 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106165.044:1463): user pid=32721 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32721 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106165.044:1464): user pid=32721 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32721 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106165.045:1465): user pid=32721 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106165.090:1466): user pid=32718 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106165.091:1467): user pid=32718 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106165.091:1468): user pid=32718 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106165.092:1469): user pid=32718 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106165.092:1470): user pid=32718 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32718 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106165.093:1471): user pid=32718 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32718 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106165.093:1472): user pid=32718 uid=0 auid=0 ses=108 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32718 suid=0 rport=52169 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106174.620:1473): user pid=32732 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32732 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106174.621:1474): user pid=32732 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32732 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106174.622:1475): user pid=32731 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32732 suid=74 rport=52172 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106174.623:1476): user pid=32731 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32732 suid=74 rport=52172 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106174.692:1477): user pid=32731 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52172 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106174.692:1478): user pid=32731 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52172 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106174.699:1479): user pid=32731 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106174.700:1480): user pid=32731 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32732 suid=74 rport=52172 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106174.700:1481): user pid=32731 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106174.701:1482): user pid=32731 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106174.701:1483): pid=32731 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=109
>type=USER_ROLE_CHANGE msg=audit(1406106174.779:1484): user pid=32731 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106174.792:1485): user pid=32731 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106174.794:1486): user pid=32731 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106174.795:1487): user pid=32731 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106174.796:1488): user pid=32734 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32734 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106174.796:1489): user pid=32734 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32734 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106174.797:1490): user pid=32734 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106174.834:1491): user pid=32731 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106174.835:1492): user pid=32731 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106174.835:1493): user pid=32731 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106174.836:1494): user pid=32731 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106174.836:1495): user pid=32731 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32731 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106174.836:1496): user pid=32731 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32731 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106174.836:1497): user pid=32731 uid=0 auid=0 ses=109 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32731 suid=0 rport=52172 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106176.453:1498): user pid=32744 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=162 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106176.512:1499): user pid=32744 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=162 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106176.513:1500): user pid=32744 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=162 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1406106176.588:1501): user pid=32749 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=162 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1406106176.588:1502): user pid=32749 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to group acct="nova" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1406106176.588:1503): user pid=32749 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to group acct="nova" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1406106176.589:1504): user pid=32749 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to shadow group acct="nova" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=ADD_USER msg=audit(1406106176.589:1505): user pid=32749 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to shadow group acct="nova" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106184.328:1506): user pid=32757 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32757 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106184.328:1507): user pid=32757 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32757 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106184.329:1508): user pid=32756 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=32757 suid=74 rport=52176 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106184.329:1509): user pid=32756 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=32757 suid=74 rport=52176 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106184.387:1510): user pid=32756 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52176 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106184.387:1511): user pid=32756 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52176 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106184.393:1512): user pid=32756 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106184.393:1513): user pid=32756 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32757 suid=74 rport=52176 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106184.393:1514): user pid=32756 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106184.394:1515): user pid=32756 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106184.394:1516): pid=32756 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=110
>type=USER_ROLE_CHANGE msg=audit(1406106184.468:1517): user pid=32756 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106184.484:1518): user pid=32756 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106184.486:1519): user pid=32756 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106184.487:1520): user pid=32756 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106184.487:1521): user pid=32760 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32760 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106184.487:1522): user pid=32760 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32760 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106184.488:1523): user pid=32760 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106184.517:1524): user pid=32756 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106184.518:1525): user pid=32756 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106184.518:1526): user pid=32756 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106184.520:1527): user pid=32756 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106184.520:1528): user pid=32756 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=32756 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106184.520:1529): user pid=32756 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=32756 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106184.520:1530): user pid=32756 uid=0 auid=0 ses=110 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32756 suid=0 rport=52176 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106192.495:1531): user pid=302 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=498 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106192.563:1532): user pid=302 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=498 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=ADD_GROUP msg=audit(1406106192.563:1533): user pid=302 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=498 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106193.949:1534): user pid=307 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=307 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106193.949:1535): user pid=307 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=307 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106193.951:1536): user pid=306 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=307 suid=74 rport=52179 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106193.951:1537): user pid=306 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=307 suid=74 rport=52179 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106194.005:1538): user pid=306 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52179 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106194.005:1539): user pid=306 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52179 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106194.010:1540): user pid=306 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106194.011:1541): user pid=306 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=307 suid=74 rport=52179 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106194.012:1542): user pid=306 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106194.012:1543): user pid=306 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106194.012:1544): pid=306 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=111
>type=USER_ROLE_CHANGE msg=audit(1406106194.092:1545): user pid=306 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106194.103:1546): user pid=306 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106194.105:1547): user pid=306 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106194.107:1548): user pid=306 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106194.108:1549): user pid=310 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=310 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106194.108:1550): user pid=310 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=310 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106194.110:1551): user pid=310 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106194.154:1552): user pid=306 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106194.155:1553): user pid=306 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106194.156:1554): user pid=306 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106194.157:1555): user pid=306 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106194.157:1556): user pid=306 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=306 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106194.157:1557): user pid=306 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=306 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106194.157:1558): user pid=306 uid=0 auid=0 ses=111 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=306 suid=0 rport=52179 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1406106203.399:1559): user pid=333 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to group acct="nova" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=USER_CHAUTHTOK msg=audit(1406106203.402:1560): user pid=333 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to shadow group acct="nova" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106203.629:1561): user pid=339 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=339 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106203.629:1562): user pid=339 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=339 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106203.629:1563): user pid=338 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=339 suid=74 rport=52182 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106203.630:1564): user pid=338 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=339 suid=74 rport=52182 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106203.687:1565): user pid=338 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52182 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106203.687:1566): user pid=338 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52182 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106203.694:1567): user pid=338 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106203.695:1568): user pid=338 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=339 suid=74 rport=52182 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106203.695:1569): user pid=338 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106203.696:1570): user pid=338 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106203.696:1571): pid=338 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=112
>type=USER_ROLE_CHANGE msg=audit(1406106203.766:1572): user pid=338 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106203.776:1573): user pid=338 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106203.778:1574): user pid=338 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106203.778:1575): user pid=338 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106203.779:1576): user pid=341 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=341 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106203.779:1577): user pid=341 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=341 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106203.781:1578): user pid=341 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106203.821:1579): user pid=338 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106203.822:1580): user pid=338 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106203.822:1581): user pid=338 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106203.823:1582): user pid=338 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106203.823:1583): user pid=338 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=338 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106203.823:1584): user pid=338 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=338 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106203.823:1585): user pid=338 uid=0 auid=0 ses=112 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=338 suid=0 rport=52182 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=ANOM_PROMISCUOUS msg=audit(1406106208.509:1586): dev=virbr0-nic prom=256 old_prom=0 auid=0 uid=0 gid=0 ses=96
>type=SYSCALL msg=audit(1406106208.509:1586): arch=c000003e syscall=16 success=yes exit=0 a0=11 a1=89a2 a2=7f76d267dae0 a3=7f76d267d840 items=0 ppid=1 pid=405 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.525:1587): table=filter family=2 entries=7
>type=SYSCALL msg=audit(1406106208.525:1587): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1d1f7a0 items=0 ppid=394 pid=444 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.528:1588): table=filter family=2 entries=8
>type=SYSCALL msg=audit(1406106208.528:1588): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=13ae920 items=0 ppid=394 pid=451 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.581:1589): table=mangle family=2 entries=0
>type=SYSCALL msg=audit(1406106208.581:1589): arch=c000003e syscall=175 success=yes exit=0 a0=21db2e0 a1=22d0 a2=21d34e0 a3=7fff36fa1300 items=0 ppid=463 pid=464 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/sbin/modprobe" subj=system_u:system_r:insmod_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.583:1590): table=mangle family=2 entries=6
>type=SYSCALL msg=audit(1406106208.583:1590): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=fb8290 items=0 ppid=394 pid=460 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.610:1591): table=filter family=2 entries=9
>type=SYSCALL msg=audit(1406106208.610:1591): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2795b50 items=0 ppid=394 pid=509 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.613:1592): table=filter family=2 entries=10
>type=SYSCALL msg=audit(1406106208.613:1592): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=fa5cd0 items=0 ppid=394 pid=512 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.615:1593): table=filter family=2 entries=11
>type=SYSCALL msg=audit(1406106208.615:1593): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=ac0620 items=0 ppid=394 pid=513 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.627:1594): table=filter family=2 entries=12
>type=SYSCALL msg=audit(1406106208.627:1594): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=c4f7a0 items=0 ppid=394 pid=521 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.630:1595): table=filter family=2 entries=13
>type=SYSCALL msg=audit(1406106208.630:1595): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=99a4d0 items=0 ppid=394 pid=522 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.632:1596): table=filter family=2 entries=14
>type=SYSCALL msg=audit(1406106208.632:1596): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=24df650 items=0 ppid=394 pid=523 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.635:1597): table=filter family=2 entries=15
>type=SYSCALL msg=audit(1406106208.635:1597): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1684250 items=0 ppid=394 pid=525 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.676:1598): table=nat family=2 entries=0
>type=SYSCALL msg=audit(1406106208.676:1598): arch=c000003e syscall=175 success=yes exit=0 a0=23cfdb0 a1=3ef0 a2=23bf4e0 a3=7fffddcb56d0 items=0 ppid=544 pid=545 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/sbin/modprobe" subj=system_u:system_r:insmod_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.679:1599): table=nat family=2 entries=4
>type=SYSCALL msg=audit(1406106208.679:1599): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=247b620 items=0 ppid=394 pid=543 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.719:1600): table=nat family=2 entries=5
>type=SYSCALL msg=audit(1406106208.719:1600): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=231d800 items=0 ppid=394 pid=552 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.720:1601): table=nat family=2 entries=6
>type=SYSCALL msg=audit(1406106208.720:1601): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=dd7700 items=0 ppid=394 pid=553 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106208.899:1602): table=filter family=10 entries=0
>type=SYSCALL msg=audit(1406106208.899:1602): arch=c000003e syscall=175 success=yes exit=0 a0=aeb2e0 a1=22c8 a2=ae34e0 a3=7fff8fb91fc0 items=0 ppid=595 pid=596 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/sbin/modprobe" subj=system_u:system_r:insmod_t:s0 key=(null)
>type=NETFILTER_CFG msg=audit(1406106209.141:1603): table=filter family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106209.141:1603): table=mangle family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106209.141:1603): table=nat family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106209.141:1603): table=filter family=10 entries=0
>type=SYSCALL msg=audit(1406106209.141:1603): arch=c000003e syscall=56 success=yes exit=705 a0=6c020011 a1=7f76cc099f60 a2=8 a3=30000a7373 items=0 ppid=1 pid=405 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=SYSCALL msg=audit(1406106209.141:1604): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7f76cc099f60 a2=8 a3=30000a7373 items=0 ppid=405 pid=705 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=96 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=FD_PAIR msg=audit(1406106209.141:1604): fd0=0 fd1=0
>type=USER_START msg=audit(1406106209.765:1605): user pid=886 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_ACQ msg=audit(1406106209.765:1606): user pid=886 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406106209.767:1607): user pid=886 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406106209.767:1608): user pid=886 uid=0 auid=0 ses=96 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106213.268:1609): user pid=1003 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1003 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106213.268:1610): user pid=1003 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1003 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106213.269:1611): user pid=1002 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1003 suid=74 rport=52187 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106213.269:1612): user pid=1002 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1003 suid=74 rport=52187 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106213.324:1613): user pid=1002 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52187 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106213.324:1614): user pid=1002 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52187 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106213.329:1615): user pid=1002 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106213.329:1616): user pid=1002 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1003 suid=74 rport=52187 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106213.330:1617): user pid=1002 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106213.331:1618): user pid=1002 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106213.331:1619): pid=1002 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=113
>type=USER_ROLE_CHANGE msg=audit(1406106213.404:1620): user pid=1002 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106213.411:1621): user pid=1002 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106213.413:1622): user pid=1002 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106213.413:1623): user pid=1002 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106213.414:1624): user pid=1005 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1005 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106213.414:1625): user pid=1005 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1005 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106213.415:1626): user pid=1005 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106213.446:1627): user pid=1002 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106213.447:1628): user pid=1002 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106213.448:1629): user pid=1002 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106213.448:1630): user pid=1002 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106213.449:1631): user pid=1002 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1002 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106213.449:1632): user pid=1002 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1002 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106213.449:1633): user pid=1002 uid=0 auid=0 ses=113 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1002 suid=0 rport=52187 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106375.957:1634): user pid=1013 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1013 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106375.957:1635): user pid=1013 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1013 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106375.957:1636): user pid=1012 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1013 suid=74 rport=52449 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106375.957:1637): user pid=1012 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1013 suid=74 rport=52449 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106376.014:1638): user pid=1012 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52449 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106376.014:1639): user pid=1012 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52449 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106376.018:1640): user pid=1012 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106376.019:1641): user pid=1012 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1013 suid=74 rport=52449 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106376.019:1642): user pid=1012 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106376.020:1643): user pid=1012 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106376.020:1644): pid=1012 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=114
>type=USER_ROLE_CHANGE msg=audit(1406106376.087:1645): user pid=1012 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106376.101:1646): user pid=1012 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106376.104:1647): user pid=1012 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106376.104:1648): user pid=1012 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106376.105:1649): user pid=1015 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1015 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106376.105:1650): user pid=1015 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1015 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106376.106:1651): user pid=1015 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106376.139:1652): user pid=1012 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106376.139:1653): user pid=1012 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106376.140:1654): user pid=1012 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106376.140:1655): user pid=1012 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106376.140:1656): user pid=1012 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1012 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106376.140:1657): user pid=1012 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1012 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106376.140:1658): user pid=1012 uid=0 auid=0 ses=114 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1012 suid=0 rport=52449 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406106376.736:1659): table=filter family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106376.736:1659): table=mangle family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106376.736:1659): table=nat family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106376.736:1659): table=filter family=10 entries=0
>type=SYSCALL msg=audit(1406106376.736:1659): arch=c000003e syscall=272 success=yes exit=0 a0=40000000 a1=c0 a2=0 a3=7fff198d5430 items=0 ppid=1129 pid=1136 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=114 comm="ip" exe="/sbin/ip" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106376.777:1660): table=filter family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106376.777:1660): table=mangle family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106376.777:1660): table=nat family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106376.777:1660): table=filter family=10 entries=0
>type=SYSCALL msg=audit(1406106376.777:1660): arch=c000003e syscall=272 success=yes exit=0 a0=40000000 a1=c0 a2=0 a3=7ffffb703b40 items=0 ppid=1129 pid=1140 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=114 comm="ip" exe="/sbin/ip" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406106377.147:1661): table=filter family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106377.147:1661): table=mangle family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106377.147:1661): table=nat family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406106377.147:1661): table=filter family=10 entries=0
>type=SYSCALL msg=audit(1406106377.147:1661): arch=c000003e syscall=272 success=yes exit=0 a0=40000000 a1=c0 a2=0 a3=7fffcb5f9430 items=0 ppid=1129 pid=1142 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=114 comm="ip" exe="/sbin/ip" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=CRYPTO_KEY_USER msg=audit(1406106382.598:1662): user pid=1371 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1371 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106382.598:1663): user pid=1371 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1371 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106382.598:1664): user pid=1370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1371 suid=74 rport=52464 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106382.598:1665): user pid=1370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1371 suid=74 rport=52464 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106382.662:1666): user pid=1370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52464 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106382.662:1667): user pid=1370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52464 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106382.667:1668): user pid=1370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106382.668:1669): user pid=1370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1371 suid=74 rport=52464 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106382.668:1670): user pid=1370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106382.669:1671): user pid=1370 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106382.669:1672): pid=1370 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=115
>type=USER_ROLE_CHANGE msg=audit(1406106382.739:1673): user pid=1370 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106382.749:1674): user pid=1370 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106382.751:1675): user pid=1370 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106382.751:1676): user pid=1370 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106382.752:1677): user pid=1373 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1373 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106382.752:1678): user pid=1373 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1373 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106382.753:1679): user pid=1373 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106382.783:1680): user pid=1370 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106382.784:1681): user pid=1370 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106382.784:1682): user pid=1370 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106382.785:1683): user pid=1370 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106382.785:1684): user pid=1370 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1370 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106382.785:1685): user pid=1370 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1370 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106382.786:1686): user pid=1370 uid=0 auid=0 ses=115 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1370 suid=0 rport=52464 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106383.881:1687): user pid=1381 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1381 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106383.882:1688): user pid=1381 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1381 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106383.882:1689): user pid=1380 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1381 suid=74 rport=52469 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106383.882:1690): user pid=1380 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1381 suid=74 rport=52469 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106383.946:1691): user pid=1380 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52469 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106383.946:1692): user pid=1380 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52469 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106383.951:1693): user pid=1380 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106383.951:1694): user pid=1380 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1381 suid=74 rport=52469 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106383.951:1695): user pid=1380 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106383.952:1696): user pid=1380 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106383.952:1697): pid=1380 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=116
>type=USER_ROLE_CHANGE msg=audit(1406106384.018:1698): user pid=1380 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106384.033:1699): user pid=1380 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106384.035:1700): user pid=1380 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106384.035:1701): user pid=1380 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.036:1702): user pid=1383 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1383 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.036:1703): user pid=1383 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1383 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106384.037:1704): user pid=1383 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106384.163:1705): user pid=1380 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106384.164:1706): user pid=1380 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106384.165:1707): user pid=1380 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106384.166:1708): user pid=1380 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.166:1709): user pid=1380 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1380 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.166:1710): user pid=1380 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1380 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.166:1711): user pid=1380 uid=0 auid=0 ses=116 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1380 suid=0 rport=52469 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.448:1712): user pid=1402 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1402 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.448:1713): user pid=1402 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1402 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106384.448:1714): user pid=1401 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1402 suid=74 rport=52471 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406106384.448:1715): user pid=1401 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1402 suid=74 rport=52471 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106384.512:1716): user pid=1401 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52471 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106384.512:1717): user pid=1401 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=52471 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106384.518:1718): user pid=1401 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.518:1719): user pid=1401 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1402 suid=74 rport=52471 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_AUTH msg=audit(1406106384.518:1720): user pid=1401 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406106384.519:1721): user pid=1401 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=LOGIN msg=audit(1406106384.519:1722): pid=1401 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=117
>type=USER_ROLE_CHANGE msg=audit(1406106384.586:1723): user pid=1401 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106384.600:1724): user pid=1401 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406106384.602:1725): user pid=1401 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_START msg=audit(1406106384.602:1726): user pid=1401 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.603:1727): user pid=1404 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1404 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.603:1728): user pid=1404 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1404 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRED_REFR msg=audit(1406106384.604:1729): user pid=1404 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106384.664:1730): user pid=1401 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406106384.665:1731): user pid=1401 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_END msg=audit(1406106384.666:1732): user pid=1401 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406106384.666:1733): user pid=1401 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.666:1734): user pid=1401 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1401 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.666:1735): user pid=1401 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1401 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406106384.666:1736): user pid=1401 uid=0 auid=0 ses=117 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1401 suid=0 rport=52471 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success'
>type=USER_ACCT msg=audit(1406106601.375:1737): user pid=1412 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406106601.376:1738): user pid=1412 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406106601.380:1739): pid=1412 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=118
>type=USER_START msg=audit(1406106601.387:1740): user pid=1412 uid=0 auid=0 ses=118 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406106601.455:1741): user pid=1412 uid=0 auid=0 ses=118 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406106601.455:1742): user pid=1412 uid=0 auid=0 ses=118 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406107201.464:1743): user pid=1415 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406107201.464:1744): user pid=1415 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406107201.464:1745): pid=1415 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=119
>type=USER_START msg=audit(1406107201.470:1746): user pid=1415 uid=0 auid=0 ses=119 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406107201.518:1747): user pid=1415 uid=0 auid=0 ses=119 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406107201.518:1748): user pid=1415 uid=0 auid=0 ses=119 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_START msg=audit(1406107445.491:1749): user pid=1446 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_ACQ msg=audit(1406107445.491:1750): user pid=1446 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success'
>type=CRED_DISP msg=audit(1406107445.493:1751): user pid=1446 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_END msg=audit(1406107445.494:1752): user pid=1446 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success'
>type=USER_CMD msg=audit(1406107680.828:1753): user pid=1534 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C206164646272206272313030 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107680.828:1754): user pid=1534 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107680.831:1755): user pid=1534 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107680.874:1756): user pid=1534 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107680.874:1757): user pid=1534 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107680.884:1758): user pid=1541 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2073657466642062723130302030 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107680.885:1759): user pid=1541 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107680.885:1760): user pid=1541 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107680.914:1761): user pid=1541 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107680.914:1762): user pid=1541 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107680.924:1763): user pid=1562 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C20737470206272313030206F6666 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107680.924:1764): user pid=1562 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107680.926:1765): user pid=1562 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107680.955:1766): user pid=1562 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107680.955:1767): user pid=1562 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107680.966:1768): user pid=1565 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B20736574206272313030207570 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107680.966:1769): user pid=1565 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107680.966:1770): user pid=1565 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107681.009:1771): user pid=1565 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107681.009:1772): user pid=1565 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107681.022:1773): user pid=1568 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107681.023:1774): user pid=1568 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107681.023:1775): user pid=1568 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=ANOM_PROMISCUOUS msg=audit(1406107681.049:1776): dev=eth0 prom=256 old_prom=0 auid=0 uid=0 gid=0 ses=53
>type=SYSCALL msg=audit(1406107681.049:1776): arch=c000003e syscall=16 success=yes exit=0 a0=3 a1=89a2 a2=7fffb56d3d50 a3=7fffb56d3aa0 items=0 ppid=1569 pid=1570 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="brctl" exe="/usr/sbin/brctl" subj=unconfined_u:system_r:brctl_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1406107681.061:1777): user pid=1568 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107681.061:1778): user pid=1568 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107681.071:1779): user pid=1571 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107681.071:1780): user pid=1571 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107681.071:1781): user pid=1571 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107681.101:1782): user pid=1571 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107681.101:1783): user pid=1571 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107681.117:1784): user pid=1575 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620697020726F7574652064656C2064656661756C74207669612031302E31362E39392E323534 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107681.117:1785): user pid=1575 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107681.118:1786): user pid=1575 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107681.146:1787): user pid=1575 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107681.146:1788): user pid=1575 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107681.163:1789): user pid=1579 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620697020616464722064656C2031302E31362E39362E3130332F3232206272642031302E31362E39392E3235352073636F706520676C6F62616C206465762065746830 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107681.164:1790): user pid=1579 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107681.164:1791): user pid=1579 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107681.194:1792): user pid=1579 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107681.194:1793): user pid=1579 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107681.204:1794): user pid=1582 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069702061646472206164642031302E31362E39362E3130332F3232206272642031302E31362E39392E3235352073636F706520676C6F62616C20646576206272313030 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107681.204:1795): user pid=1582 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107681.204:1796): user pid=1582 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107681.233:1797): user pid=1582 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107681.234:1798): user pid=1582 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107681.244:1799): user pid=1585 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620697020726F757465206164642064656661756C74207669612031302E31362E39392E323534 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107681.244:1800): user pid=1585 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107681.244:1801): user pid=1585 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107681.273:1802): user pid=1585 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107681.273:1803): user pid=1585 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107681.757:1804): user pid=1588 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107681.757:1805): user pid=1588 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107681.757:1806): user pid=1588 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107681.799:1807): user pid=1588 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107681.799:1808): user pid=1588 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107681.814:1809): user pid=1592 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107681.814:1810): user pid=1592 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107681.814:1811): user pid=1592 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406107681.840:1812): table=nat family=2 entries=7
>type=SYSCALL msg=audit(1406107681.840:1812): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=aeb890 items=0 ppid=1593 pid=1594 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107681.841:1813): table=mangle family=2 entries=7
>type=SYSCALL msg=audit(1406107681.841:1813): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=aeba90 items=0 ppid=1593 pid=1594 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107681.842:1814): table=filter family=2 entries=16
>type=SYSCALL msg=audit(1406107681.842:1814): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=aefbb0 items=0 ppid=1593 pid=1594 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1406107681.845:1815): user pid=1592 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107681.845:1816): user pid=1592 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107681.896:1817): user pid=1596 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107681.896:1818): user pid=1596 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107681.896:1819): user pid=1596 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107681.927:1820): user pid=1596 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107681.927:1821): user pid=1596 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107681.937:1822): user pid=1600 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107681.937:1823): user pid=1600 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107681.938:1824): user pid=1600 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406107681.964:1825): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406107681.964:1825): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=16484a0 items=0 ppid=1601 pid=1602 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107681.964:1826): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406107681.964:1826): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1647c40 items=0 ppid=1601 pid=1602 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107681.965:1827): table=filter family=2 entries=39
>type=SYSCALL msg=audit(1406107681.965:1827): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=164cd20 items=0 ppid=1601 pid=1602 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1406107681.969:1828): user pid=1600 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107681.969:1829): user pid=1600 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107681.979:1830): user pid=1604 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107681.979:1831): user pid=1604 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107681.980:1832): user pid=1604 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107682.010:1833): user pid=1604 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107682.010:1834): user pid=1604 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107682.021:1835): user pid=1608 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107682.021:1836): user pid=1608 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107682.021:1837): user pid=1608 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406107682.047:1838): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406107682.047:1838): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=28104a0 items=0 ppid=1609 pid=1610 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107682.047:1839): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406107682.047:1839): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=280fc40 items=0 ppid=1609 pid=1610 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107682.049:1840): table=filter family=2 entries=48
>type=SYSCALL msg=audit(1406107682.049:1840): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2815530 items=0 ppid=1609 pid=1610 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1406107682.052:1841): user pid=1608 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107682.052:1842): user pid=1608 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107682.333:1843): user pid=1613 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1613 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107682.333:1844): user pid=1613 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1613 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406107682.334:1845): user pid=1612 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1613 suid=74 rport=46582 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406107682.334:1846): user pid=1612 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1613 suid=74 rport=46582 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=AVC msg=audit(1406107682.389:1847): avc:  denied  { search } for  pid=1612 comm="sshd" name="nova" dev=dm-0 ino=1968242 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1406107682.389:1847): arch=c000003e syscall=2 success=no exit=-13 a0=7fb14e27b550 a1=800 a2=1 a3=c items=0 ppid=21253 pid=1612 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=67 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1406107682.389:1848): avc:  denied  { search } for  pid=1612 comm="sshd" name="nova" dev=dm-0 ino=1968242 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1406107682.389:1848): arch=c000003e syscall=2 success=no exit=-13 a0=7fb14e27b550 a1=800 a2=1 a3=24 items=0 ppid=21253 pid=1612 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=67 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1406107682.389:1849): user pid=1612 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1406107682.389:1850): user pid=1612 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=none acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1406107682.390:1851): user pid=1612 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1406107682.391:1852): user pid=1612 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=ssh res=failed'
>type=CRYPTO_KEY_USER msg=audit(1406107682.392:1853): user pid=1612 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1613 suid=74 rport=46582 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_ERR msg=audit(1406107682.456:1854): user pid=1612 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident acct="?" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=failed'
>type=CRYPTO_KEY_USER msg=audit(1406107682.456:1855): user pid=1612 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1612 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107682.456:1856): user pid=1612 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1612 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_LOGIN msg=audit(1406107682.456:1857): user pid=1612 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=ssh res=failed'
>type=USER_CMD msg=audit(1406107683.229:1858): user pid=1614 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107683.229:1859): user pid=1614 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107683.230:1860): user pid=1614 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107683.260:1861): user pid=1614 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107683.260:1862): user pid=1614 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107683.271:1863): user pid=1618 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107683.271:1864): user pid=1618 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107683.271:1865): user pid=1618 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406107683.297:1866): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406107683.297:1866): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=22b24a0 items=0 ppid=1619 pid=1620 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107683.297:1867): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406107683.297:1867): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=22b1c40 items=0 ppid=1619 pid=1620 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107683.298:1868): table=filter family=2 entries=50
>type=SYSCALL msg=audit(1406107683.298:1868): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=22b73c0 items=0 ppid=1619 pid=1620 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1406107683.302:1869): user pid=1618 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107683.302:1870): user pid=1618 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=MAC_STATUS msg=audit(1406107763.334:1871): enforcing=0 old_enforcing=1 auid=0 ses=53
>type=SYSCALL msg=audit(1406107763.334:1871): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fffafcd60e0 a2=1 a3=7fffafcd4e60 items=0 ppid=15266 pid=1622 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=53 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_CMD msg=audit(1406107781.784:1872): user pid=1664 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107781.784:1873): user pid=1664 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107781.784:1874): user pid=1664 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107781.813:1875): user pid=1664 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107781.813:1876): user pid=1664 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107781.823:1877): user pid=1667 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107781.823:1878): user pid=1667 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107781.824:1879): user pid=1667 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107781.855:1880): user pid=1667 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107781.855:1881): user pid=1667 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107782.290:1882): user pid=1672 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107782.290:1883): user pid=1672 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107782.290:1884): user pid=1672 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107782.324:1885): user pid=1672 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107782.324:1886): user pid=1672 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107782.335:1887): user pid=1676 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107782.335:1888): user pid=1676 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107782.335:1889): user pid=1676 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406107782.361:1890): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406107782.361:1890): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=9ed4a0 items=0 ppid=1677 pid=1678 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107782.362:1891): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406107782.362:1891): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=9ecc40 items=0 ppid=1677 pid=1678 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107782.363:1892): table=filter family=2 entries=41
>type=SYSCALL msg=audit(1406107782.363:1892): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=9f2540 items=0 ppid=1677 pid=1678 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1406107782.366:1893): user pid=1676 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107782.366:1894): user pid=1676 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107782.423:1895): user pid=1681 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1681 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107782.423:1896): user pid=1681 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1681 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406107782.423:1897): user pid=1680 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1681 suid=74 rport=46583 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406107782.424:1898): user pid=1680 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1681 suid=74 rport=46583 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=AVC msg=audit(1406107782.478:1899): avc:  denied  { search } for  pid=1680 comm="sshd" name="nova" dev=dm-0 ino=1968242 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1406107782.478:1899): avc:  denied  { read } for  pid=1680 comm="sshd" name="authorized_keys" dev=dm-0 ino=1968323 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file
>type=AVC msg=audit(1406107782.478:1899): avc:  denied  { open } for  pid=1680 comm="sshd" name="authorized_keys" dev=dm-0 ino=1968323 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1406107782.478:1899): arch=c000003e syscall=2 success=yes exit=4 a0=7f0926702570 a1=800 a2=1 a3=c items=0 ppid=21253 pid=1680 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=67 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1406107782.478:1900): avc:  denied  { getattr } for  pid=1680 comm="sshd" path="/var/lib/nova/.ssh/authorized_keys" dev=dm-0 ino=1968323 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1406107782.478:1900): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7fff019950b0 a2=7fff019950b0 a3=c items=0 ppid=21253 pid=1680 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=67 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1406107782.478:1901): avc:  denied  { getattr } for  pid=1680 comm="sshd" path="/var/lib/nova" dev=dm-0 ino=1968242 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1406107782.478:1901): arch=c000003e syscall=6 success=yes exit=0 a0=7fff01996140 a1=7fff01994f40 a2=7fff01994f40 a3=22 items=0 ppid=21253 pid=1680 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=67 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1406107782.478:1902): user pid=1680 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=46583 acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_AUTH msg=audit(1406107782.478:1903): user pid=1680 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=91:58:6f:e0:55:20:c9:33:dd:fb:4c:87:e2:a8:08:f8 rport=46583 acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_ACCT msg=audit(1406107782.483:1904): user pid=1680 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107782.483:1905): user pid=1680 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1681 suid=74 rport=46583 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_AUTH msg=audit(1406107782.484:1906): user pid=1680 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406107782.484:1907): user pid=1680 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=LOGIN msg=audit(1406107782.484:1908): pid=1680 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=162 old ses=67 new ses=120
>type=USER_ROLE_CHANGE msg=audit(1406107782.559:1909): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_START msg=audit(1406107782.569:1910): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107782.570:1911): user pid=1683 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1683 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107782.570:1912): user pid=1683 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1683 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107782.570:1913): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1680 suid=0 rport=46583 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107782.571:1914): user pid=1683 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406107782.575:1915): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_START msg=audit(1406107782.576:1916): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107782.582:1917): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1683 suid=162 rport=46583 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_END msg=audit(1406107782.583:1918): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406107782.584:1919): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_END msg=audit(1406107782.584:1920): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406107782.585:1921): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107782.585:1922): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1680 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406107782.585:1923): user pid=1680 uid=0 auid=162 ses=120 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1680 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_CMD msg=audit(1406107783.439:1924): user pid=1685 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107783.441:1925): user pid=1685 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107783.443:1926): user pid=1685 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406107783.490:1927): user pid=1685 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107783.490:1928): user pid=1685 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406107783.502:1929): user pid=1689 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406107783.502:1930): user pid=1689 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406107783.502:1931): user pid=1689 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406107783.528:1932): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406107783.528:1932): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=91c4a0 items=0 ppid=1690 pid=1691 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107783.529:1933): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406107783.529:1933): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=91bc40 items=0 ppid=1690 pid=1691 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107783.531:1934): table=filter family=2 entries=50
>type=SYSCALL msg=audit(1406107783.531:1934): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=9213c0 items=0 ppid=1690 pid=1691 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1406107783.535:1935): user pid=1689 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406107783.535:1936): user pid=1689 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1406107801.541:1937): user pid=1693 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406107801.541:1938): user pid=1693 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406107801.545:1939): pid=1693 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=121
>type=USER_START msg=audit(1406107801.551:1940): user pid=1693 uid=0 auid=0 ses=121 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406107801.608:1941): user pid=1693 uid=0 auid=0 ses=121 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406107801.608:1942): user pid=1693 uid=0 auid=0 ses=121 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=NETFILTER_CFG msg=audit(1406107993.919:1943): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406107993.919:1943): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=10e0aa0 items=0 ppid=1727 pid=1742 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.920:1944): table=nat family=2 entries=24
>type=SYSCALL msg=audit(1406107993.920:1944): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=b30910 items=0 ppid=1727 pid=1743 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.922:1945): table=nat family=2 entries=23
>type=SYSCALL msg=audit(1406107993.922:1945): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1b9b5b0 items=0 ppid=1727 pid=1744 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.923:1946): table=filter family=2 entries=41
>type=SYSCALL msg=audit(1406107993.923:1946): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=8ab000 items=0 ppid=1727 pid=1745 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.924:1947): table=filter family=2 entries=40
>type=SYSCALL msg=audit(1406107993.924:1947): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=83d3d0 items=0 ppid=1727 pid=1746 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.926:1948): table=filter family=2 entries=39
>type=SYSCALL msg=audit(1406107993.926:1948): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=15af260 items=0 ppid=1727 pid=1747 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.927:1949): table=filter family=2 entries=38
>type=SYSCALL msg=audit(1406107993.927:1949): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=11fa520 items=0 ppid=1727 pid=1748 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.928:1950): table=filter family=2 entries=37
>type=SYSCALL msg=audit(1406107993.928:1950): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=233b3b0 items=0 ppid=1727 pid=1749 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.930:1951): table=filter family=2 entries=36
>type=SYSCALL msg=audit(1406107993.930:1951): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=20c6a80 items=0 ppid=1727 pid=1750 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.931:1952): table=filter family=2 entries=35
>type=SYSCALL msg=audit(1406107993.931:1952): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=176b910 items=0 ppid=1727 pid=1751 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.932:1953): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406107993.932:1953): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=22f1120 items=0 ppid=1727 pid=1752 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.934:1954): table=filter family=2 entries=34
>type=SYSCALL msg=audit(1406107993.934:1954): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=d3a6d0 items=0 ppid=1727 pid=1753 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.935:1955): table=filter family=2 entries=33
>type=SYSCALL msg=audit(1406107993.935:1955): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=27a2560 items=0 ppid=1727 pid=1754 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.936:1956): table=filter family=2 entries=32
>type=SYSCALL msg=audit(1406107993.936:1956): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=20f0560 items=0 ppid=1727 pid=1755 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.938:1957): table=filter family=2 entries=33
>type=SYSCALL msg=audit(1406107993.938:1957): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1aee6e0 items=0 ppid=1727 pid=1756 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.939:1958): table=mangle family=2 entries=9
>type=SYSCALL msg=audit(1406107993.939:1958): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1b84060 items=0 ppid=1727 pid=1757 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.940:1959): table=filter family=2 entries=34
>type=SYSCALL msg=audit(1406107993.940:1959): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1730910 items=0 ppid=1727 pid=1758 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.942:1960): table=filter family=2 entries=35
>type=SYSCALL msg=audit(1406107993.942:1960): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=19ffa90 items=0 ppid=1727 pid=1759 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.943:1961): table=filter family=2 entries=36
>type=SYSCALL msg=audit(1406107993.943:1961): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=24ce3b0 items=0 ppid=1727 pid=1760 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.944:1962): table=filter family=2 entries=37
>type=SYSCALL msg=audit(1406107993.944:1962): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=24d3530 items=0 ppid=1727 pid=1761 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.945:1963): table=filter family=2 entries=38
>type=SYSCALL msg=audit(1406107993.945:1963): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=19c8260 items=0 ppid=1727 pid=1762 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.946:1964): table=filter family=2 entries=39
>type=SYSCALL msg=audit(1406107993.946:1964): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=23163e0 items=0 ppid=1727 pid=1763 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.948:1965): table=filter family=2 entries=40
>type=SYSCALL msg=audit(1406107993.948:1965): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=240b010 items=0 ppid=1727 pid=1764 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.949:1966): table=nat family=2 entries=22
>type=SYSCALL msg=audit(1406107993.949:1966): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=27c25c0 items=0 ppid=1727 pid=1765 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.950:1967): table=nat family=2 entries=23
>type=SYSCALL msg=audit(1406107993.950:1967): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=da3910 items=0 ppid=1727 pid=1766 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107993.951:1968): table=nat family=2 entries=24
>type=SYSCALL msg=audit(1406107993.951:1968): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=c59ab0 items=0 ppid=1727 pid=1767 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406107994.175:1969): table=filter family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406107994.175:1969): table=mangle family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406107994.175:1969): table=nat family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406107994.175:1969): table=filter family=10 entries=0
>type=SYSCALL msg=audit(1406107994.175:1969): arch=c000003e syscall=56 success=yes exit=1818 a0=6c020011 a1=7fb5740ebf80 a2=8 a3=30000a7373 items=0 ppid=1 pid=1738 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=SYSCALL msg=audit(1406107994.175:1970): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7fb5740ebf80 a2=8 a3=30000a7373 items=0 ppid=1738 pid=1818 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=FD_PAIR msg=audit(1406107994.175:1970): fd0=0 fd1=0
>type=USER_CMD msg=audit(1406108031.630:1971): user pid=1861 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108031.630:1972): user pid=1861 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406108031.633:1973): user pid=1861 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406108031.666:1974): user pid=1861 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406108031.666:1975): user pid=1861 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406108031.677:1976): user pid=1864 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108031.677:1977): user pid=1864 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406108031.677:1978): user pid=1864 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406108031.708:1979): user pid=1864 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406108031.708:1980): user pid=1864 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406108032.133:1981): user pid=1869 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108032.133:1982): user pid=1869 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406108032.133:1983): user pid=1869 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406108032.175:1984): user pid=1869 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406108032.175:1985): user pid=1869 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406108032.186:1986): user pid=1873 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108032.186:1987): user pid=1873 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406108032.186:1988): user pid=1873 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406108032.214:1989): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406108032.214:1989): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=18ea3c0 items=0 ppid=1874 pid=1875 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108032.214:1990): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406108032.214:1990): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=18ea100 items=0 ppid=1874 pid=1875 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108032.215:1991): table=filter family=2 entries=41
>type=SYSCALL msg=audit(1406108032.215:1991): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=18ef540 items=0 ppid=1874 pid=1875 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1406108032.219:1992): user pid=1873 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406108032.219:1993): user pid=1873 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108032.602:1994): user pid=1878 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1878 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108032.602:1995): user pid=1878 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1878 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406108032.603:1996): user pid=1877 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1878 suid=74 rport=46584 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406108032.604:1997): user pid=1877 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1878 suid=74 rport=46584 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=AVC msg=audit(1406108032.661:1998): avc:  denied  { search } for  pid=1877 comm="sshd" name="nova" dev=dm-0 ino=1968242 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1406108032.661:1998): avc:  denied  { read } for  pid=1877 comm="sshd" name="authorized_keys" dev=dm-0 ino=1968323 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file
>type=AVC msg=audit(1406108032.661:1998): avc:  denied  { open } for  pid=1877 comm="sshd" name="authorized_keys" dev=dm-0 ino=1968323 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1406108032.661:1998): arch=c000003e syscall=2 success=yes exit=4 a0=7fcfb8d4d570 a1=800 a2=1 a3=c items=0 ppid=21253 pid=1877 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=67 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1406108032.661:1999): avc:  denied  { getattr } for  pid=1877 comm="sshd" path="/var/lib/nova/.ssh/authorized_keys" dev=dm-0 ino=1968323 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1406108032.661:1999): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7fff36dc0390 a2=7fff36dc0390 a3=c items=0 ppid=21253 pid=1877 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=67 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1406108032.661:2000): avc:  denied  { getattr } for  pid=1877 comm="sshd" path="/var/lib/nova" dev=dm-0 ino=1968242 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1406108032.661:2000): arch=c000003e syscall=6 success=yes exit=0 a0=7fff36dc1420 a1=7fff36dc0220 a2=7fff36dc0220 a3=22 items=0 ppid=21253 pid=1877 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=67 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1406108032.661:2001): user pid=1877 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=46584 acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_AUTH msg=audit(1406108032.661:2002): user pid=1877 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=91:58:6f:e0:55:20:c9:33:dd:fb:4c:87:e2:a8:08:f8 rport=46584 acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_ACCT msg=audit(1406108033.255:2003): user pid=1877 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108033.255:2004): user pid=1877 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1878 suid=74 rport=46584 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_AUTH msg=audit(1406108033.256:2005): user pid=1877 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406108033.256:2006): user pid=1877 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=LOGIN msg=audit(1406108033.256:2007): pid=1877 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=162 old ses=67 new ses=122
>type=USER_ROLE_CHANGE msg=audit(1406108033.330:2008): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_START msg=audit(1406108033.341:2009): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108033.342:2010): user pid=1880 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1880 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108033.342:2011): user pid=1880 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1880 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108033.342:2012): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1877 suid=0 rport=46584 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108033.343:2013): user pid=1880 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406108033.347:2014): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_START msg=audit(1406108033.348:2015): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108033.354:2016): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1880 suid=162 rport=46584 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_END msg=audit(1406108033.355:2017): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406108033.356:2018): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_END msg=audit(1406108033.356:2019): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406108033.357:2020): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108033.357:2021): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1877 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108033.357:2022): user pid=1877 uid=0 auid=162 ses=122 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1877 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_CMD msg=audit(1406108034.241:2023): user pid=1882 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108034.242:2024): user pid=1882 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406108034.245:2025): user pid=1882 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406108034.289:2026): user pid=1882 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406108034.289:2027): user pid=1882 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406108034.300:2028): user pid=1886 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108034.300:2029): user pid=1886 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406108034.301:2030): user pid=1886 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406108034.327:2031): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406108034.327:2031): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1cd93c0 items=0 ppid=1887 pid=1888 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108034.328:2032): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406108034.328:2032): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1cd9100 items=0 ppid=1887 pid=1888 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108034.329:2033): table=filter family=2 entries=50
>type=SYSCALL msg=audit(1406108034.329:2033): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1cde390 items=0 ppid=1887 pid=1888 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1406108034.332:2034): user pid=1886 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406108034.332:2035): user pid=1886 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406108218.464:2036): user pid=1932 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108218.464:2037): user pid=1932 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406108218.466:2038): user pid=1932 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406108218.499:2039): user pid=1932 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406108218.499:2040): user pid=1932 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406108218.509:2041): user pid=1935 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108218.509:2042): user pid=1935 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406108218.509:2043): user pid=1935 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406108218.541:2044): user pid=1935 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406108218.541:2045): user pid=1935 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406108218.971:2046): user pid=1940 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108218.971:2047): user pid=1940 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406108218.971:2048): user pid=1940 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406108219.005:2049): user pid=1940 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406108219.005:2050): user pid=1940 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406108219.015:2051): user pid=1944 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108219.015:2052): user pid=1944 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406108219.015:2053): user pid=1944 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406108219.041:2054): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406108219.041:2054): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1f233c0 items=0 ppid=1945 pid=1946 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108219.041:2055): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406108219.041:2055): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1f23100 items=0 ppid=1945 pid=1946 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108219.043:2056): table=filter family=2 entries=41
>type=SYSCALL msg=audit(1406108219.043:2056): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1f28540 items=0 ppid=1945 pid=1946 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1406108219.047:2057): user pid=1944 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406108219.047:2058): user pid=1944 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108219.127:2059): user pid=1949 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1949 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108219.128:2060): user pid=1949 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1949 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406108219.129:2061): user pid=1948 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=1949 suid=74 rport=46585 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406108219.129:2062): user pid=1948 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=1949 suid=74 rport=46585 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=AVC msg=audit(1406108219.184:2063): avc:  denied  { search } for  pid=1948 comm="sshd" name="nova" dev=dm-0 ino=1968242 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir
>type=AVC msg=audit(1406108219.184:2063): avc:  denied  { read } for  pid=1948 comm="sshd" name="authorized_keys" dev=dm-0 ino=1968323 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file
>type=AVC msg=audit(1406108219.184:2063): avc:  denied  { open } for  pid=1948 comm="sshd" name="authorized_keys" dev=dm-0 ino=1968323 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1406108219.184:2063): arch=c000003e syscall=2 success=yes exit=4 a0=7f2e73c21590 a1=800 a2=1 a3=c items=0 ppid=21253 pid=1948 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=67 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1406108219.184:2064): avc:  denied  { getattr } for  pid=1948 comm="sshd" path="/var/lib/nova/.ssh/authorized_keys" dev=dm-0 ino=1968323 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file
>type=SYSCALL msg=audit(1406108219.184:2064): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7fffbd5ed560 a2=7fffbd5ed560 a3=c items=0 ppid=21253 pid=1948 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=67 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=AVC msg=audit(1406108219.184:2065): avc:  denied  { getattr } for  pid=1948 comm="sshd" path="/var/lib/nova" dev=dm-0 ino=1968242 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir
>type=SYSCALL msg=audit(1406108219.184:2065): arch=c000003e syscall=6 success=yes exit=0 a0=7fffbd5ee5f0 a1=7fffbd5ed3f0 a2=7fffbd5ed3f0 a3=22 items=0 ppid=21253 pid=1948 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=67 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
>type=USER_AUTH msg=audit(1406108219.184:2066): user pid=1948 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=46585 acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_AUTH msg=audit(1406108219.184:2067): user pid=1948 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=91:58:6f:e0:55:20:c9:33:dd:fb:4c:87:e2:a8:08:f8 rport=46585 acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_ACCT msg=audit(1406108219.191:2068): user pid=1948 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108219.191:2069): user pid=1948 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1949 suid=74 rport=46585 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_AUTH msg=audit(1406108219.191:2070): user pid=1948 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406108219.192:2071): user pid=1948 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=LOGIN msg=audit(1406108219.192:2072): pid=1948 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=162 old ses=67 new ses=123
>type=USER_ROLE_CHANGE msg=audit(1406108219.264:2073): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_START msg=audit(1406108219.273:2074): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108219.273:2075): user pid=1951 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1951 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108219.274:2076): user pid=1951 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1951 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108219.274:2077): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1948 suid=0 rport=46585 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406108219.275:2078): user pid=1951 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406108219.279:2079): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_START msg=audit(1406108219.280:2080): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=VIRT_MACHINE_ID msg=audit(1406108219.370:2081): user pid=1727 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 vm-ctx=unconfined_u:system_r:svirt_t:s0:c94,c790 img-ctx=unconfined_u:object_r:svirt_image_t:s0:c94,c790 model=selinux exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
>type=VIRT_MACHINE_ID msg=audit(1406108219.370:2082): user pid=1727 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 vm-ctx=107:107 img-ctx=107:107 model=dac exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
>type=ANOM_PROMISCUOUS msg=audit(1406108219.388:2083): dev=vnet0 prom=256 old_prom=0 auid=0 uid=0 gid=0 ses=53
>type=SYSCALL msg=audit(1406108219.388:2083): arch=c000003e syscall=16 success=yes exit=0 a0=1c a1=89a2 a2=7fb57ed13af0 a3=7fb57ed13850 items=0 ppid=1 pid=1732 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=VIRT_RESOURCE msg=audit(1406108219.398:2084): user pid=1727 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=net reason=open vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 net=FA:16:3E:36:8F:1B path="/dev/net/tun" rdev=0A:C8 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
>type=VIRT_RESOURCE msg=audit(1406108219.570:2085): user pid=1727 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=net reason=open vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 net=FA:16:3E:36:8F:1B path="/dev/vhost-net" rdev=0A:39 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
>type=VIRT_RESOURCE msg=audit(1406108219.865:2086): user pid=1727 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-disk="?" new-disk="/var/lib/nova/instances/8c02e375-acb8-4231-80fa-bf36e529c560/disk" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
>type=VIRT_RESOURCE msg=audit(1406108219.865:2087): user pid=1727 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=net reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-net=? new-net=FA:16:3E:36:8F:1B exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
>type=VIRT_RESOURCE msg=audit(1406108219.865:2088): user pid=1727 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=mem reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-mem=0 new-mem=2097152 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
>type=VIRT_RESOURCE msg=audit(1406108219.865:2089): user pid=1727 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=vcpu reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-vcpu=0 new-vcpu=1 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
>type=VIRT_CONTROL msg=audit(1406108219.865:2090): user pid=1727 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm op=start reason=migrated vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 vm-pid=2180 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1406108401.640:2091): user pid=2206 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406108401.640:2092): user pid=2206 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406108401.643:2093): pid=2206 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=124
>type=USER_START msg=audit(1406108401.649:2094): user pid=2206 uid=0 auid=0 ses=124 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406108401.756:2095): user pid=2206 uid=0 auid=0 ses=124 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406108401.756:2096): user pid=2206 uid=0 auid=0 ses=124 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108412.894:2097): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=1951 suid=162 rport=46585 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=USER_END msg=audit(1406108412.966:2098): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406108412.967:2099): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_END msg=audit(1406108412.968:2100): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406108412.968:2101): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-13.idm.lab.bos.redhat.com addr=10.16.96.102 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108412.968:2102): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=1948 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406108412.968:2103): user pid=1948 uid=0 auid=162 ses=123 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=1948 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.16.96.102 terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406108571.981:2104): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406108571.981:2104): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=25d0aa0 items=0 ppid=2260 pid=2275 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.983:2105): table=nat family=2 entries=24
>type=SYSCALL msg=audit(1406108571.983:2105): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1283910 items=0 ppid=2260 pid=2276 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.984:2106): table=nat family=2 entries=23
>type=SYSCALL msg=audit(1406108571.984:2106): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=10705b0 items=0 ppid=2260 pid=2277 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.986:2107): table=filter family=2 entries=50
>type=SYSCALL msg=audit(1406108571.986:2107): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1b5ad30 items=0 ppid=2260 pid=2278 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.987:2108): table=filter family=2 entries=49
>type=SYSCALL msg=audit(1406108571.987:2108): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=a5e100 items=0 ppid=2260 pid=2279 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.988:2109): table=filter family=2 entries=48
>type=SYSCALL msg=audit(1406108571.988:2109): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=21d0f90 items=0 ppid=2260 pid=2280 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.989:2110): table=filter family=2 entries=47
>type=SYSCALL msg=audit(1406108571.989:2110): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=ebe250 items=0 ppid=2260 pid=2281 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.991:2111): table=filter family=2 entries=46
>type=SYSCALL msg=audit(1406108571.991:2111): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=27be0e0 items=0 ppid=2260 pid=2282 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.992:2112): table=filter family=2 entries=45
>type=SYSCALL msg=audit(1406108571.992:2112): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=27bf7b0 items=0 ppid=2260 pid=2283 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.994:2113): table=filter family=2 entries=44
>type=SYSCALL msg=audit(1406108571.994:2113): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1749640 items=0 ppid=2260 pid=2284 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.995:2114): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406108571.995:2114): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1518120 items=0 ppid=2260 pid=2285 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.996:2115): table=filter family=2 entries=43
>type=SYSCALL msg=audit(1406108571.996:2115): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=213f400 items=0 ppid=2260 pid=2286 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.998:2116): table=filter family=2 entries=42
>type=SYSCALL msg=audit(1406108571.998:2116): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=137e290 items=0 ppid=2260 pid=2287 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108571.999:2117): table=filter family=2 entries=41
>type=SYSCALL msg=audit(1406108571.999:2117): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=cd1290 items=0 ppid=2260 pid=2288 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.000:2118): table=filter family=2 entries=42
>type=SYSCALL msg=audit(1406108572.000:2118): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2300410 items=0 ppid=2260 pid=2289 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.002:2119): table=mangle family=2 entries=9
>type=SYSCALL msg=audit(1406108572.002:2119): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=278e060 items=0 ppid=2260 pid=2290 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.003:2120): table=filter family=2 entries=43
>type=SYSCALL msg=audit(1406108572.003:2120): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1c96640 items=0 ppid=2260 pid=2291 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.004:2121): table=filter family=2 entries=44
>type=SYSCALL msg=audit(1406108572.004:2121): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=11617c0 items=0 ppid=2260 pid=2292 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.006:2122): table=filter family=2 entries=45
>type=SYSCALL msg=audit(1406108572.006:2122): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=20d90e0 items=0 ppid=2260 pid=2293 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.007:2123): table=filter family=2 entries=46
>type=SYSCALL msg=audit(1406108572.007:2123): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1dea260 items=0 ppid=2260 pid=2294 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.008:2124): table=filter family=2 entries=47
>type=SYSCALL msg=audit(1406108572.008:2124): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=14f0f90 items=0 ppid=2260 pid=2295 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.009:2125): table=filter family=2 entries=48
>type=SYSCALL msg=audit(1406108572.009:2125): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1b61110 items=0 ppid=2260 pid=2296 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.011:2126): table=filter family=2 entries=49
>type=SYSCALL msg=audit(1406108572.011:2126): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1335d40 items=0 ppid=2260 pid=2297 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.012:2127): table=nat family=2 entries=22
>type=SYSCALL msg=audit(1406108572.012:2127): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=243e5c0 items=0 ppid=2260 pid=2298 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.013:2128): table=nat family=2 entries=23
>type=SYSCALL msg=audit(1406108572.013:2128): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1967910 items=0 ppid=2260 pid=2299 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.015:2129): table=nat family=2 entries=24
>type=SYSCALL msg=audit(1406108572.015:2129): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2403ab0 items=0 ppid=2260 pid=2300 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108572.242:2130): table=filter family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406108572.242:2130): table=mangle family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406108572.242:2130): table=nat family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406108572.242:2130): table=filter family=10 entries=0
>type=SYSCALL msg=audit(1406108572.242:2131): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7f972c1671a0 a2=8 a3=a7373 items=0 ppid=2271 pid=2367 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=FD_PAIR msg=audit(1406108572.242:2131): fd0=0 fd1=0
>type=SYSCALL msg=audit(1406108572.242:2130): arch=c000003e syscall=56 success=yes exit=2367 a0=6c020011 a1=7f972c1671a0 a2=8 a3=a7373 items=0 ppid=1 pid=2271 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=MAC_STATUS msg=audit(1406108637.704:2132): enforcing=1 old_enforcing=0 auid=0 ses=53
>type=SYSCALL msg=audit(1406108637.704:2132): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff87ec23b0 a2=1 a3=7fff87ec1130 items=0 ppid=15266 pid=2589 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=53 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.950:2133): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406108856.950:2133): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=25aaaa0 items=0 ppid=2667 pid=2682 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.952:2134): table=nat family=2 entries=24
>type=SYSCALL msg=audit(1406108856.952:2134): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=966910 items=0 ppid=2667 pid=2683 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.954:2135): table=nat family=2 entries=23
>type=SYSCALL msg=audit(1406108856.954:2135): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=19765b0 items=0 ppid=2667 pid=2684 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.955:2136): table=filter family=2 entries=50
>type=SYSCALL msg=audit(1406108856.955:2136): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1ba1d30 items=0 ppid=2667 pid=2685 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.956:2137): table=filter family=2 entries=49
>type=SYSCALL msg=audit(1406108856.956:2137): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1481100 items=0 ppid=2667 pid=2686 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.958:2138): table=filter family=2 entries=48
>type=SYSCALL msg=audit(1406108856.958:2138): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=dcaf90 items=0 ppid=2667 pid=2687 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.959:2139): table=filter family=2 entries=47
>type=SYSCALL msg=audit(1406108856.959:2139): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=27ae250 items=0 ppid=2667 pid=2688 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.960:2140): table=filter family=2 entries=46
>type=SYSCALL msg=audit(1406108856.960:2140): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=c5a0e0 items=0 ppid=2667 pid=2689 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.962:2141): table=filter family=2 entries=45
>type=SYSCALL msg=audit(1406108856.962:2141): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=aa97b0 items=0 ppid=2667 pid=2690 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.963:2142): table=filter family=2 entries=44
>type=SYSCALL msg=audit(1406108856.963:2142): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=19de640 items=0 ppid=2667 pid=2691 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.964:2143): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406108856.964:2143): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2779120 items=0 ppid=2667 pid=2692 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.966:2144): table=filter family=2 entries=43
>type=SYSCALL msg=audit(1406108856.966:2144): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2512400 items=0 ppid=2667 pid=2693 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.967:2145): table=filter family=2 entries=42
>type=SYSCALL msg=audit(1406108856.967:2145): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=e04290 items=0 ppid=2667 pid=2694 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.968:2146): table=filter family=2 entries=41
>type=SYSCALL msg=audit(1406108856.968:2146): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=999290 items=0 ppid=2667 pid=2695 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.970:2147): table=filter family=2 entries=42
>type=SYSCALL msg=audit(1406108856.970:2147): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1eb0410 items=0 ppid=2667 pid=2696 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.971:2148): table=mangle family=2 entries=9
>type=SYSCALL msg=audit(1406108856.971:2148): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=26fe060 items=0 ppid=2667 pid=2697 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.972:2149): table=filter family=2 entries=43
>type=SYSCALL msg=audit(1406108856.972:2149): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2318640 items=0 ppid=2667 pid=2698 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.974:2150): table=filter family=2 entries=44
>type=SYSCALL msg=audit(1406108856.974:2150): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=12dd7c0 items=0 ppid=2667 pid=2699 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.975:2151): table=filter family=2 entries=45
>type=SYSCALL msg=audit(1406108856.975:2151): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=130d0e0 items=0 ppid=2667 pid=2700 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.976:2152): table=filter family=2 entries=46
>type=SYSCALL msg=audit(1406108856.976:2152): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=e78260 items=0 ppid=2667 pid=2701 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.977:2153): table=filter family=2 entries=47
>type=SYSCALL msg=audit(1406108856.977:2153): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=13f3f90 items=0 ppid=2667 pid=2702 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.979:2154): table=filter family=2 entries=48
>type=SYSCALL msg=audit(1406108856.979:2154): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=118e110 items=0 ppid=2667 pid=2703 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.980:2155): table=filter family=2 entries=49
>type=SYSCALL msg=audit(1406108856.980:2155): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=192ad40 items=0 ppid=2667 pid=2704 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.981:2156): table=nat family=2 entries=22
>type=SYSCALL msg=audit(1406108856.981:2156): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=25275c0 items=0 ppid=2667 pid=2705 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.983:2157): table=nat family=2 entries=23
>type=SYSCALL msg=audit(1406108856.983:2157): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=9c4910 items=0 ppid=2667 pid=2706 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108856.984:2158): table=nat family=2 entries=24
>type=SYSCALL msg=audit(1406108856.984:2158): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=998ab0 items=0 ppid=2667 pid=2707 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108857.210:2159): table=filter family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406108857.210:2159): table=mangle family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406108857.210:2159): table=nat family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406108857.210:2159): table=filter family=10 entries=0
>type=SYSCALL msg=audit(1406108857.210:2159): arch=c000003e syscall=56 success=yes exit=2774 a0=6c020011 a1=7f2fe8166dc0 a2=8 a3=a7373 items=0 ppid=1 pid=2678 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=SYSCALL msg=audit(1406108857.210:2160): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7f2fe8166dc0 a2=8 a3=a7373 items=0 ppid=2678 pid=2774 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=FD_PAIR msg=audit(1406108857.210:2160): fd0=0 fd1=0
>type=NETFILTER_CFG msg=audit(1406108931.041:2161): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406108931.041:2161): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=b8faa0 items=0 ppid=3039 pid=3054 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.043:2162): table=nat family=2 entries=24
>type=SYSCALL msg=audit(1406108931.043:2162): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=d57910 items=0 ppid=3039 pid=3055 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.044:2163): table=nat family=2 entries=23
>type=SYSCALL msg=audit(1406108931.044:2163): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=8a15b0 items=0 ppid=3039 pid=3056 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.045:2164): table=filter family=2 entries=50
>type=SYSCALL msg=audit(1406108931.045:2164): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=146cd30 items=0 ppid=3039 pid=3057 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.046:2165): table=filter family=2 entries=49
>type=SYSCALL msg=audit(1406108931.046:2165): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=238c100 items=0 ppid=3039 pid=3058 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.048:2166): table=filter family=2 entries=48
>type=SYSCALL msg=audit(1406108931.048:2166): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=a6df90 items=0 ppid=3039 pid=3059 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.049:2167): table=filter family=2 entries=47
>type=SYSCALL msg=audit(1406108931.049:2167): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=220a250 items=0 ppid=3039 pid=3060 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.050:2168): table=filter family=2 entries=46
>type=SYSCALL msg=audit(1406108931.050:2168): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=11400e0 items=0 ppid=3039 pid=3061 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.052:2169): table=filter family=2 entries=45
>type=SYSCALL msg=audit(1406108931.052:2169): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1b717b0 items=0 ppid=3039 pid=3062 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.053:2170): table=filter family=2 entries=44
>type=SYSCALL msg=audit(1406108931.053:2170): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=f3e640 items=0 ppid=3039 pid=3063 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.054:2171): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406108931.054:2171): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=212f120 items=0 ppid=3039 pid=3064 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.056:2172): table=filter family=2 entries=43
>type=SYSCALL msg=audit(1406108931.056:2172): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1a53400 items=0 ppid=3039 pid=3065 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.057:2173): table=filter family=2 entries=42
>type=SYSCALL msg=audit(1406108931.057:2173): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1027290 items=0 ppid=3039 pid=3066 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.058:2174): table=filter family=2 entries=41
>type=SYSCALL msg=audit(1406108931.058:2174): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1daf290 items=0 ppid=3039 pid=3067 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.060:2175): table=filter family=2 entries=42
>type=SYSCALL msg=audit(1406108931.060:2175): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1037410 items=0 ppid=3039 pid=3068 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.061:2176): table=mangle family=2 entries=9
>type=SYSCALL msg=audit(1406108931.061:2176): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=93f060 items=0 ppid=3039 pid=3069 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.063:2177): table=filter family=2 entries=43
>type=SYSCALL msg=audit(1406108931.063:2177): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=14e9640 items=0 ppid=3039 pid=3070 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.064:2178): table=filter family=2 entries=44
>type=SYSCALL msg=audit(1406108931.064:2178): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=fda7c0 items=0 ppid=3039 pid=3071 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.065:2179): table=filter family=2 entries=45
>type=SYSCALL msg=audit(1406108931.065:2179): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=17200e0 items=0 ppid=3039 pid=3072 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.066:2180): table=filter family=2 entries=46
>type=SYSCALL msg=audit(1406108931.066:2180): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1e45260 items=0 ppid=3039 pid=3073 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.068:2181): table=filter family=2 entries=47
>type=SYSCALL msg=audit(1406108931.068:2181): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=101ff90 items=0 ppid=3039 pid=3074 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.069:2182): table=filter family=2 entries=48
>type=SYSCALL msg=audit(1406108931.069:2182): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=a70110 items=0 ppid=3039 pid=3075 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.070:2183): table=filter family=2 entries=49
>type=SYSCALL msg=audit(1406108931.070:2183): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1ecdd40 items=0 ppid=3039 pid=3076 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.072:2184): table=nat family=2 entries=22
>type=SYSCALL msg=audit(1406108931.072:2184): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=f845c0 items=0 ppid=3039 pid=3077 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.073:2185): table=nat family=2 entries=23
>type=SYSCALL msg=audit(1406108931.073:2185): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1ef1910 items=0 ppid=3039 pid=3078 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.074:2186): table=nat family=2 entries=24
>type=SYSCALL msg=audit(1406108931.074:2186): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=125aab0 items=0 ppid=3039 pid=3079 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406108931.262:2187): table=filter family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406108931.262:2187): table=mangle family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406108931.262:2187): table=nat family=2 entries=0
>type=NETFILTER_CFG msg=audit(1406108931.262:2187): table=filter family=10 entries=0
>type=SYSCALL msg=audit(1406108931.262:2187): arch=c000003e syscall=56 success=yes exit=3146 a0=6c020011 a1=7fe6301745d0 a2=8 a3=a7373 items=0 ppid=1 pid=3050 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=SYSCALL msg=audit(1406108931.262:2188): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7fe6301745d0 a2=8 a3=a7373 items=0 ppid=3050 pid=3146 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)
>type=FD_PAIR msg=audit(1406108931.262:2188): fd0=0 fd1=0
>type=USER_ACCT msg=audit(1406109001.778:2189): user pid=3373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406109001.778:2190): user pid=3373 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406109001.782:2191): pid=3373 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=125
>type=USER_START msg=audit(1406109001.791:2192): user pid=3373 uid=0 auid=0 ses=125 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406109001.863:2193): user pid=3373 uid=0 auid=0 ses=125 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406109001.863:2194): user pid=3373 uid=0 auid=0 ses=125 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=MAC_STATUS msg=audit(1406109006.109:2195): enforcing=0 old_enforcing=1 auid=0 ses=53
>type=SYSCALL msg=audit(1406109006.109:2195): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff44141930 a2=1 a3=7fff441406b0 items=0 ppid=15266 pid=3376 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=53 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=ANOM_PROMISCUOUS msg=audit(1406109282.105:2196): dev=vnet0 prom=0 old_prom=256 auid=0 uid=107 gid=107 ses=53
>type=SYSCALL msg=audit(1406109282.105:2196): arch=c000003e syscall=3 success=yes exit=0 a0=1b a1=7fffa42067e0 a2=8 a3=0 items=0 ppid=1 pid=2180 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=53 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=unconfined_u:system_r:svirt_t:s0:c94,c790 key=(null)
>type=VIRT_CONTROL msg=audit(1406109282.481:2197): user pid=3039 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm op=stop reason=migrated vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 vm-pid=-1 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406109282.527:2198): user pid=3575 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620636174202F6574632F69736373692F696E69746961746F726E616D652E6973637369 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406109282.527:2199): user pid=3575 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406109282.530:2200): user pid=3575 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406109282.559:2201): user pid=3575 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406109282.559:2202): user pid=3575 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406109282.568:2203): user pid=3578 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620737973746F6F6C202D632066635F686F7374202D76 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406109282.568:2204): user pid=3578 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406109282.569:2205): user pid=3578 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406109282.598:2206): user pid=3578 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406109282.598:2207): user pid=3578 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406109282.608:2208): user pid=3581 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620737973746F6F6C202D632066635F686F7374202D76 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406109282.608:2209): user pid=3581 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406109282.608:2210): user pid=3581 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406109282.637:2211): user pid=3581 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406109282.637:2212): user pid=3581 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406109282.919:2213): user pid=3584 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406109282.919:2214): user pid=3584 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406109282.921:2215): user pid=3584 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_END msg=audit(1406109282.961:2216): user pid=3584 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406109282.961:2217): user pid=3584 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_CMD msg=audit(1406109282.975:2218): user pid=3588 uid=162 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success'
>type=CRED_ACQ msg=audit(1406109282.975:2219): user pid=3588 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_START msg=audit(1406109282.976:2220): user pid=3588 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=NETFILTER_CFG msg=audit(1406109283.002:2221): table=nat family=2 entries=25
>type=SYSCALL msg=audit(1406109283.002:2221): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=23ae3c0 items=0 ppid=3589 pid=3590 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406109283.002:2222): table=mangle family=2 entries=10
>type=SYSCALL msg=audit(1406109283.002:2222): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=23ae100 items=0 ppid=3589 pid=3590 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=NETFILTER_CFG msg=audit(1406109283.004:2223): table=filter family=2 entries=50
>type=SYSCALL msg=audit(1406109283.004:2223): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=23b3390 items=0 ppid=3589 pid=3590 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=53 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null)
>type=USER_END msg=audit(1406109283.007:2224): user pid=3588 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=CRED_DISP msg=audit(1406109283.007:2225): user pid=3588 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1406109601.879:2226): user pid=3592 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406109601.879:2227): user pid=3592 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406109601.880:2228): pid=3592 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=126
>type=USER_START msg=audit(1406109601.888:2229): user pid=3592 uid=0 auid=0 ses=126 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406109601.943:2230): user pid=3592 uid=0 auid=0 ses=126 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406109601.943:2231): user pid=3592 uid=0 auid=0 ses=126 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406109661.947:2232): user pid=3597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406109661.947:2233): user pid=3597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406109661.948:2234): pid=3597 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=127
>type=USER_START msg=audit(1406109661.952:2235): user pid=3597 uid=0 auid=0 ses=127 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406109661.967:2236): user pid=3597 uid=0 auid=0 ses=127 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406109661.967:2237): user pid=3597 uid=0 auid=0 ses=127 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1406110201.973:2238): user pid=3614 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1406110201.973:2239): user pid=3614 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1406110201.974:2240): pid=3614 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=128
>type=USER_START msg=audit(1406110201.979:2241): user pid=3614 uid=0 auid=0 ses=128 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1406110202.033:2242): user pid=3614 uid=0 auid=0 ses=128 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1406110202.033:2243): user pid=3614 uid=0 auid=0 ses=128 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110205.794:2244): user pid=3618 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=3618 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110205.794:2245): user pid=3618 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=3618 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406110206.058:2246): user pid=3617 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=3618 suid=74 rport=51724 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406110206.058:2247): user pid=3617 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=3618 suid=74 rport=51724 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_AUTH msg=audit(1406110221.969:2248): user pid=3617 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51724 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_AUTH msg=audit(1406110221.969:2249): user pid=3617 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=30:fc:fa:a3:71:ac:1b:8b:03:8b:4e:4b:5f:37:dc:af rport=51724 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_ACCT msg=audit(1406110222.005:2250): user pid=3617 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110222.005:2251): user pid=3617 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3618 suid=74 rport=51724 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_AUTH msg=audit(1406110222.006:2252): user pid=3617 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406110222.006:2253): user pid=3617 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=LOGIN msg=audit(1406110222.007:2254): pid=3617 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=129
>type=USER_ROLE_CHANGE msg=audit(1406110222.082:2255): user pid=3617 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_START msg=audit(1406110222.093:2256): user pid=3617 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406110222.514:2257): user pid=3617 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_START msg=audit(1406110222.515:2258): user pid=3617 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110222.515:2259): user pid=3620 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=3620 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110222.516:2260): user pid=3620 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=3620 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRED_REFR msg=audit(1406110222.517:2261): user pid=3620 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_END msg=audit(1406110224.313:2262): user pid=3617 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1406110224.314:2263): user pid=3617 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_END msg=audit(1406110224.317:2264): user pid=3617 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1406110224.319:2265): user pid=3617 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110224.320:2266): user pid=3617 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=3617 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110224.320:2267): user pid=3617 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=3617 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110224.320:2268): user pid=3617 uid=0 auid=0 ses=129 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3617 suid=0 rport=51724 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110273.417:2269): user pid=3628 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=3628 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110273.417:2270): user pid=3628 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=3628 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406110273.744:2271): user pid=3627 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=3628 suid=74 rport=51731 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1406110273.744:2272): user pid=3627 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=3628 suid=74 rport=51731 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_AUTH msg=audit(1406110300.814:2273): user pid=3627 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51731 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_AUTH msg=audit(1406110300.814:2274): user pid=3627 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=30:fc:fa:a3:71:ac:1b:8b:03:8b:4e:4b:5f:37:dc:af rport=51731 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_ACCT msg=audit(1406110300.818:2275): user pid=3627 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110300.818:2276): user pid=3627 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=3628 suid=74 rport=51731 laddr=10.16.96.103 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=USER_AUTH msg=audit(1406110300.819:2277): user pid=3627 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1406110300.819:2278): user pid=3627 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=LOGIN msg=audit(1406110300.819:2279): pid=3627 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=67 new ses=130
>type=USER_ROLE_CHANGE msg=audit(1406110300.885:2280): user pid=3627 uid=0 auid=0 ses=130 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_START msg=audit(1406110300.899:2281): user pid=3627 uid=0 auid=0 ses=130 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1406110301.330:2282): user pid=3627 uid=0 auid=0 ses=130 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=USER_START msg=audit(1406110301.331:2283): user pid=3627 uid=0 auid=0 ses=130 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110301.331:2284): user pid=3630 uid=0 auid=0 ses=130 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=1c:c1:61:d8:ce:8b:d1:c6:a3:e7:d7:9c:23:6e:5e:75 direction=? spid=3630 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1406110301.331:2285): user pid=3630 uid=0 auid=0 ses=130 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=92:af:6f:e9:7a:4d:65:e9:f2:30:43:61:d5:07:17:19 direction=? spid=3630 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success'
>type=CRED_REFR msg=audit(1406110301.332:2286): user pid=3630 uid=0 auid=0 ses=130 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'

Actions: View

Attachments on bug 1122457: 920186 | 920187 | 920189 | 920190