Login
[x]
Log in using an account from:
Fedora Account System
Red Hat Associate
Red Hat Customer
Or login using a Red Hat Bugzilla account
Forgot Password
Login:
Hide Forgot
Create an Account
Red Hat Bugzilla – Attachment 920190 Details for
Bug 1122457
Live Migration failure: operation failed: Failed to connect to remote libvirt URI
[?]
New
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
|
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh83 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
This site requires JavaScript to be enabled to function correctly, please enable it.
/var/log/audit/audit.log on target compute node
audit-target-node.log (text/plain), 649.03 KB, created by
Gabriel Szasz
on 2014-07-23 10:15:55 UTC
(
hide
)
Description:
/var/log/audit/audit.log on target compute node
Filename:
MIME Type:
Creator:
Gabriel Szasz
Created:
2014-07-23 10:15:55 UTC
Size:
649.03 KB
patch
obsolete
>type=CRYPTO_KEY_USER msg=audit(1406098607.921:17): user pid=6598 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=6598 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406098607.921:18): user pid=6598 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=6598 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406098608.185:19): user pid=6597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=6598 suid=74 rport=51465 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406098608.185:20): user pid=6597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=6598 suid=74 rport=51465 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406098624.252:21): user pid=6597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=51465 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406098624.252:22): user pid=6597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=30:fc:fa:a3:71:ac:1b:8b:03:8b:4e:4b:5f:37:dc:af rport=51465 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_ACCT msg=audit(1406098624.447:23): user pid=6597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406098624.447:24): user pid=6597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=6598 suid=74 rport=51465 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406098624.447:25): user pid=6597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406098624.448:26): user pid=6597 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=LOGIN msg=audit(1406098624.449:27): pid=6597 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1 >type=USER_ROLE_CHANGE msg=audit(1406098624.564:28): user pid=6597 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_START msg=audit(1406098624.569:29): user pid=6597 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406098625.003:30): user pid=6600 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=/dev/pts/0 res=success' >type=USER_START msg=audit(1406098625.004:31): user pid=6600 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=/dev/pts/0 res=success' >type=CRYPTO_KEY_USER msg=audit(1406098625.005:32): user pid=6600 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=6600 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=pts/0 res=success' >type=CRYPTO_KEY_USER msg=audit(1406098625.005:33): user pid=6600 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=6600 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=pts/0 res=success' >type=CRED_REFR msg=audit(1406098625.006:34): user pid=6600 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_ACCT msg=audit(1406098801.713:35): user pid=6617 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406098801.714:36): user pid=6617 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406098801.721:37): pid=6617 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2 >type=USER_START msg=audit(1406098801.727:38): user pid=6617 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406098801.816:39): user pid=6617 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406098801.817:40): user pid=6617 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406098861.823:41): user pid=6620 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406098861.824:42): user pid=6620 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406098861.824:43): pid=6620 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3 >type=USER_START msg=audit(1406098861.831:44): user pid=6620 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406098861.929:45): user pid=6620 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406098861.929:46): user pid=6620 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406099401.936:47): user pid=6636 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406099401.936:48): user pid=6636 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406099401.937:49): pid=6636 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4 >type=USER_START msg=audit(1406099401.945:50): user pid=6636 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406099402.018:51): user pid=6636 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406099402.018:52): user pid=6636 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406100001.024:53): user pid=6641 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406100001.025:54): user pid=6641 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406100001.025:55): pid=6641 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5 >type=USER_START msg=audit(1406100001.031:56): user pid=6641 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406100001.078:57): user pid=6641 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406100001.078:58): user pid=6641 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406100601.084:59): user pid=6644 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406100601.084:60): user pid=6644 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406100601.085:61): pid=6644 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6 >type=USER_START msg=audit(1406100601.090:62): user pid=6644 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406100601.146:63): user pid=6644 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406100601.146:64): user pid=6644 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406101201.153:65): user pid=6648 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406101201.153:66): user pid=6648 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406101201.153:67): pid=6648 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7 >type=USER_START msg=audit(1406101201.159:68): user pid=6648 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406101201.205:69): user pid=6648 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406101201.205:70): user pid=6648 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406101801.232:71): user pid=15022 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406101801.232:72): user pid=15022 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406101801.235:73): pid=15022 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8 >type=USER_START msg=audit(1406101801.241:74): user pid=15022 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406101801.309:75): user pid=15022 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406101801.309:76): user pid=15022 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406102401.315:77): user pid=15028 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406102401.315:78): user pid=15028 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406102401.315:79): pid=15028 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=9 >type=USER_START msg=audit(1406102401.321:80): user pid=15028 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406102401.384:81): user pid=15028 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406102401.384:82): user pid=15028 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406102461.390:83): user pid=15034 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406102461.390:84): user pid=15034 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406102461.390:85): pid=15034 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=10 >type=USER_START msg=audit(1406102461.396:86): user pid=15034 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406102461.412:87): user pid=15034 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406102461.412:88): user pid=15034 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406103001.419:89): user pid=15046 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406103001.419:90): user pid=15046 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406103001.419:91): pid=15046 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=11 >type=USER_START msg=audit(1406103001.425:92): user pid=15046 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406103001.487:93): user pid=15046 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406103001.487:94): user pid=15046 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406103601.493:95): user pid=15050 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406103601.493:96): user pid=15050 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406103601.493:97): pid=15050 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=12 >type=USER_START msg=audit(1406103601.498:98): user pid=15050 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406103601.554:99): user pid=15050 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406103601.554:100): user pid=15050 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRYPTO_KEY_USER msg=audit(1406104077.573:101): user pid=15063 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=15063 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104077.573:102): user pid=15063 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=15063 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406104077.575:103): user pid=15062 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=15063 suid=74 rport=59942 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406104077.575:104): user pid=15062 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=15063 suid=74 rport=59942 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406104077.633:105): user pid=15062 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406104077.649:106): user pid=15062 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_ACCT msg=audit(1406104077.652:107): user pid=15062 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406104077.652:108): user pid=15062 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=15063 suid=74 rport=59942 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406104077.653:109): user pid=15062 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406104077.654:110): user pid=15062 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406104077.654:111): pid=15062 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=13 >type=USER_ROLE_CHANGE msg=audit(1406104077.734:112): user pid=15062 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406104077.737:113): user pid=15062 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406104077.739:114): user pid=15062 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406104077.739:115): user pid=15062 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406104077.740:116): user pid=15066 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=15066 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104077.740:117): user pid=15066 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=15066 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406104077.741:118): user pid=15066 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406104077.869:119): user pid=15062 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406104077.870:120): user pid=15062 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406104077.871:121): user pid=15062 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406104077.871:122): user pid=15062 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406104077.871:123): user pid=15062 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=15062 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104077.871:124): user pid=15062 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=15062 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104077.872:125): user pid=15062 uid=0 auid=0 ses=13 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=15062 suid=0 rport=59942 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104079.653:126): user pid=15077 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=15077 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104079.654:127): user pid=15077 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=15077 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406104079.654:128): user pid=15076 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=15077 suid=74 rport=59945 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406104079.654:129): user pid=15076 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=15077 suid=74 rport=59945 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406104079.718:130): user pid=15076 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=59945 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406104079.718:131): user pid=15076 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=59945 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406104079.723:132): user pid=15076 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406104079.723:133): user pid=15076 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=15077 suid=74 rport=59945 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406104079.724:134): user pid=15076 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406104079.725:135): user pid=15076 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406104079.725:136): pid=15076 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=14 >type=USER_ROLE_CHANGE msg=audit(1406104079.796:137): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406104079.799:138): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406104079.802:139): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406104079.803:140): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406104079.805:141): user pid=15079 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=/dev/pts/1 res=success' >type=CRYPTO_KEY_USER msg=audit(1406104079.805:142): user pid=15079 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=15079 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=pts/1 res=success' >type=CRYPTO_KEY_USER msg=audit(1406104079.805:143): user pid=15079 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=15079 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=pts/1 res=success' >type=CRED_REFR msg=audit(1406104079.806:144): user pid=15079 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406104079.850:145): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/1 res=success' >type=USER_END msg=audit(1406104079.852:146): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406104079.853:147): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406104079.854:148): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406104079.854:149): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406104079.855:150): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=15076 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104079.855:151): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=15076 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104079.855:152): user pid=15076 uid=0 auid=0 ses=14 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=15076 suid=0 rport=59945 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406104201.584:153): user pid=15087 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406104201.584:154): user pid=15087 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406104201.591:155): pid=15087 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=15 >type=USER_START msg=audit(1406104201.597:156): user pid=15087 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406104201.676:157): user pid=15087 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406104201.676:158): user pid=15087 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRYPTO_KEY_USER msg=audit(1406104426.253:159): user pid=15091 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=15091 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104426.253:160): user pid=15091 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=15091 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406104426.254:161): user pid=15090 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=15091 suid=74 rport=59948 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406104426.254:162): user pid=15090 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=15091 suid=74 rport=59948 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406104426.321:163): user pid=15090 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=59948 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406104426.321:164): user pid=15090 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=59948 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406104426.326:165): user pid=15090 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406104426.326:166): user pid=15090 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=15091 suid=74 rport=59948 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406104426.327:167): user pid=15090 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406104426.327:168): user pid=15090 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406104426.328:169): pid=15090 uid=0 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=16 >type=USER_ROLE_CHANGE msg=audit(1406104426.401:170): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406104426.406:171): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406104426.411:172): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406104426.411:173): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406104426.413:174): user pid=15093 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=/dev/pts/1 res=success' >type=CRYPTO_KEY_USER msg=audit(1406104426.413:175): user pid=15093 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=15093 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=pts/1 res=success' >type=CRYPTO_KEY_USER msg=audit(1406104426.414:176): user pid=15093 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=15093 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=pts/1 res=success' >type=CRED_REFR msg=audit(1406104426.414:177): user pid=15093 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406104554.093:178): user pid=5558 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=5558 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104554.093:179): user pid=5558 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=5558 suid=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success' >type=ADD_USER msg=audit(1406104627.856:180): user pid=15314 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="postfix" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed' >type=ADD_USER msg=audit(1406104627.856:181): user pid=15314 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="postfix" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed' >type=ADD_USER msg=audit(1406104631.446:182): user pid=15751 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed' >type=ADD_USER msg=audit(1406104631.446:183): user pid=15751 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed' >type=USER_ACCT msg=audit(1406104631.598:184): user pid=15756 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=changing /etc/group; group nfsnobody/65534 acct="nfsnobody" exe="/usr/sbin/groupmod" hostname=? addr=? terminal=? res=success' >type=USER_ACCT msg=audit(1406104631.600:185): user pid=15756 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=modifying group acct="nfsnobody" exe="/usr/sbin/groupmod" hostname=? addr=? terminal=? res=success' >type=MAC_POLICY_LOAD msg=audit(1406104658.601:186): policy loaded auid=0 ses=16 >type=SYSCALL msg=audit(1406104658.601:186): arch=c000003e syscall=1 success=yes exit=7295329 a0=4 a1=7f1055d78000 a2=6f5161 a3=7fff2939e330 items=0 ppid=15779 pid=15784 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=16 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null) >type=DAEMON_END msg=audit(1406104701.633:5568): auditd normal halt, sending auid=0 pid=15952 subj=unconfined_u:system_r:initrc_t:s0 res=success >type=DAEMON_START msg=audit(1406104701.775:966): auditd start, ver=2.2 format=raw kernel=2.6.32-431.el6.x86_64 auid=0 pid=15972 subj=unconfined_u:system_r:auditd_t:s0 res=success >type=CONFIG_CHANGE msg=audit(1406104701.880:189): audit_backlog_limit=320 old=320 auid=0 ses=16 subj=unconfined_u:system_r:auditctl_t:s0 res=1 >type=USER_END msg=audit(1406104776.768:190): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/1 res=success' >type=USER_END msg=audit(1406104776.836:191): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406104776.836:192): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406104776.837:193): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406104776.838:194): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406104776.838:195): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=15090 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104776.838:196): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=15090 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406104776.838:197): user pid=15090 uid=0 auid=0 ses=16 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=15090 suid=0 rport=59948 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406104801.868:198): user pid=25289 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406104801.869:199): user pid=25289 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406104801.876:200): pid=25289 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=17 >type=USER_START msg=audit(1406104801.882:201): user pid=25289 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406104801.948:202): user pid=25289 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406104801.948:203): user pid=25289 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRYPTO_KEY_USER msg=audit(1406105375.122:204): user pid=25292 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25292 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105375.122:205): user pid=25292 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25292 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105375.137:206): user pid=25294 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25294 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105375.137:207): user pid=25294 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25294 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105375.137:208): user pid=25293 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25294 suid=74 rport=59953 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105375.137:209): user pid=25293 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25294 suid=74 rport=59953 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105375.201:210): user pid=25293 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=59953 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105375.201:211): user pid=25293 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=59953 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105375.271:212): user pid=25293 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105375.271:213): user pid=25293 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25294 suid=74 rport=59953 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105375.271:214): user pid=25293 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105375.272:215): user pid=25293 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105375.272:216): pid=25293 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=18 >type=USER_ROLE_CHANGE msg=audit(1406105375.355:217): user pid=25293 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105375.364:218): user pid=25293 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105375.367:219): user pid=25293 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105375.368:220): user pid=25293 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105375.369:221): user pid=25297 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25297 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105375.369:222): user pid=25297 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25297 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105375.370:223): user pid=25297 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105375.508:224): user pid=25293 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105375.509:225): user pid=25293 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105375.510:226): user pid=25293 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105375.510:227): user pid=25293 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105375.510:228): user pid=25293 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25293 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105375.510:229): user pid=25293 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25293 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105375.511:230): user pid=25293 uid=0 auid=0 ses=18 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25293 suid=0 rport=59953 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.151:231): user pid=25310 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25310 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.151:232): user pid=25310 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25310 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105376.151:233): user pid=25309 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25310 suid=74 rport=59956 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105376.151:234): user pid=25309 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25310 suid=74 rport=59956 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105376.212:235): user pid=25309 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=59956 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105376.212:236): user pid=25309 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=59956 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105376.220:237): user pid=25309 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.220:238): user pid=25309 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25310 suid=74 rport=59956 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105376.221:239): user pid=25309 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105376.222:240): user pid=25309 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105376.222:241): pid=25309 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=19 >type=USER_ROLE_CHANGE msg=audit(1406105376.296:242): user pid=25309 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105376.307:243): user pid=25309 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105376.308:244): user pid=25309 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105376.315:245): user pid=25309 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.316:246): user pid=25312 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25312 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.316:247): user pid=25312 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25312 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105376.317:248): user pid=25312 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105376.364:249): user pid=25309 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105376.364:250): user pid=25309 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105376.365:251): user pid=25309 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105376.366:252): user pid=25309 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.366:253): user pid=25309 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25309 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.366:254): user pid=25309 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25309 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.366:255): user pid=25309 uid=0 auid=0 ses=19 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25309 suid=0 rport=59956 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.382:256): user pid=25321 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25321 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.382:257): user pid=25321 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25321 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105376.382:258): user pid=25320 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25321 suid=74 rport=59957 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105376.383:259): user pid=25320 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25321 suid=74 rport=59957 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105376.442:260): user pid=25320 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=59957 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105376.442:261): user pid=25320 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=59957 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105376.449:262): user pid=25320 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.449:263): user pid=25320 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25321 suid=74 rport=59957 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105376.450:264): user pid=25320 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105376.450:265): user pid=25320 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105376.451:266): pid=25320 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=20 >type=USER_ROLE_CHANGE msg=audit(1406105376.521:267): user pid=25320 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105376.531:268): user pid=25320 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105376.533:269): user pid=25320 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105376.533:270): user pid=25320 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.534:271): user pid=25323 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25323 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.534:272): user pid=25323 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25323 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105376.536:273): user pid=25323 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105376.583:274): user pid=25320 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105376.584:275): user pid=25320 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105376.585:276): user pid=25320 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105376.586:277): user pid=25320 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.586:278): user pid=25320 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25320 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.586:279): user pid=25320 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25320 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105376.586:280): user pid=25320 uid=0 auid=0 ses=20 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25320 suid=0 rport=59957 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.510:281): user pid=25335 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25335 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.510:282): user pid=25335 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25335 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105377.510:283): user pid=25334 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25335 suid=74 rport=59962 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105377.510:284): user pid=25334 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25335 suid=74 rport=59962 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105377.577:285): user pid=25334 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=59962 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105377.578:286): user pid=25334 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=59962 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105377.584:287): user pid=25334 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.585:288): user pid=25334 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25335 suid=74 rport=59962 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105377.585:289): user pid=25334 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105377.587:290): user pid=25334 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105377.587:291): pid=25334 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=21 >type=USER_ROLE_CHANGE msg=audit(1406105377.656:292): user pid=25334 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105377.667:293): user pid=25334 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105377.670:294): user pid=25334 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105377.670:295): user pid=25334 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.671:296): user pid=25337 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25337 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.671:297): user pid=25337 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25337 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105377.672:298): user pid=25337 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105377.752:299): user pid=25334 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105377.753:300): user pid=25334 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105377.754:301): user pid=25334 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105377.755:302): user pid=25334 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.755:303): user pid=25334 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25334 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.755:304): user pid=25334 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25334 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.755:305): user pid=25334 uid=0 auid=0 ses=21 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25334 suid=0 rport=59962 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.768:306): user pid=25346 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25346 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.768:307): user pid=25346 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25346 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105377.769:308): user pid=25345 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25346 suid=74 rport=59963 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105377.769:309): user pid=25345 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25346 suid=74 rport=59963 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105377.829:310): user pid=25345 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=59963 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105377.829:311): user pid=25345 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=59963 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105377.836:312): user pid=25345 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.836:313): user pid=25345 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25346 suid=74 rport=59963 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105377.837:314): user pid=25345 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105377.839:315): user pid=25345 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105377.839:316): pid=25345 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=22 >type=USER_ROLE_CHANGE msg=audit(1406105377.909:317): user pid=25345 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105377.920:318): user pid=25345 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105377.922:319): user pid=25345 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105377.923:320): user pid=25345 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.924:321): user pid=25348 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25348 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105377.924:322): user pid=25348 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25348 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105377.925:323): user pid=25348 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105378.243:324): user pid=25345 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105378.244:325): user pid=25345 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105378.245:326): user pid=25345 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105378.245:327): user pid=25345 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105378.245:328): user pid=25345 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25345 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105378.245:329): user pid=25345 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25345 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105378.245:330): user pid=25345 uid=0 auid=0 ses=22 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25345 suid=0 rport=59963 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105378.299:331): user pid=25357 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25357 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105378.299:332): user pid=25357 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25357 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105378.299:333): user pid=25356 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25357 suid=74 rport=59964 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105378.299:334): user pid=25356 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25357 suid=74 rport=59964 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105378.360:335): user pid=25356 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=59964 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105378.360:336): user pid=25356 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=59964 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105378.367:337): user pid=25356 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105378.367:338): user pid=25356 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25357 suid=74 rport=59964 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105378.368:339): user pid=25356 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105378.369:340): user pid=25356 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105378.369:341): pid=25356 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=23 >type=USER_ROLE_CHANGE msg=audit(1406105378.438:342): user pid=25356 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105378.448:343): user pid=25356 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105378.450:344): user pid=25356 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105378.450:345): user pid=25356 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105378.451:346): user pid=25359 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25359 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105378.452:347): user pid=25359 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25359 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105378.453:348): user pid=25359 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105386.169:349): user pid=25356 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105386.170:350): user pid=25356 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105386.171:351): user pid=25356 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105386.171:352): user pid=25356 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105386.171:353): user pid=25356 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25356 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105386.171:354): user pid=25356 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25356 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105386.171:355): user pid=25356 uid=0 auid=0 ses=23 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25356 suid=0 rport=59964 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105401.976:356): user pid=25369 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406105401.976:357): user pid=25369 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406105401.983:358): pid=25369 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=24 >type=USER_START msg=audit(1406105401.992:359): user pid=25369 uid=0 auid=0 ses=24 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406105402.069:360): user pid=25369 uid=0 auid=0 ses=24 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406105402.069:361): user pid=25369 uid=0 auid=0 ses=24 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRYPTO_KEY_USER msg=audit(1406105417.865:362): user pid=25373 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25373 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105417.865:363): user pid=25373 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25373 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105417.866:364): user pid=25372 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25373 suid=74 rport=60014 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105417.866:365): user pid=25372 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25373 suid=74 rport=60014 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105417.872:366): user pid=25372 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25373 suid=74 rport=60014 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105417.872:367): user pid=25372 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25372 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105417.872:368): user pid=25372 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25372 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_LOGIN msg=audit(1406105417.873:369): user pid=25372 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct=28756E6B6E6F776E207573657229 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=failed' >type=CRYPTO_KEY_USER msg=audit(1406105417.921:370): user pid=25375 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25375 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105417.922:371): user pid=25375 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25375 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105417.922:372): user pid=25374 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25375 suid=74 rport=60016 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105417.922:373): user pid=25374 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25375 suid=74 rport=60016 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105417.983:374): user pid=25374 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60016 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105417.983:375): user pid=25374 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60016 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105417.990:376): user pid=25374 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105417.990:377): user pid=25374 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25375 suid=74 rport=60016 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105417.991:378): user pid=25374 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105417.992:379): user pid=25374 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105417.992:380): pid=25374 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=25 >type=USER_ROLE_CHANGE msg=audit(1406105418.064:381): user pid=25374 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105418.075:382): user pid=25374 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105418.078:383): user pid=25374 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105418.078:384): user pid=25374 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.079:385): user pid=25377 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25377 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.079:386): user pid=25377 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25377 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105418.081:387): user pid=25377 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105418.134:388): user pid=25374 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105418.135:389): user pid=25374 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105418.136:390): user pid=25374 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105418.136:391): user pid=25374 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.136:392): user pid=25374 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25374 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.137:393): user pid=25374 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25374 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.137:394): user pid=25374 uid=0 auid=0 ses=25 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25374 suid=0 rport=60016 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.149:395): user pid=25386 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25386 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.149:396): user pid=25386 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25386 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105418.149:397): user pid=25385 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25386 suid=74 rport=60017 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105418.149:398): user pid=25385 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25386 suid=74 rport=60017 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105418.209:399): user pid=25385 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60017 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105418.209:400): user pid=25385 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60017 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105418.216:401): user pid=25385 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.216:402): user pid=25385 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25386 suid=74 rport=60017 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105418.217:403): user pid=25385 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105418.219:404): user pid=25385 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105418.219:405): pid=25385 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=26 >type=USER_ROLE_CHANGE msg=audit(1406105418.289:406): user pid=25385 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105418.301:407): user pid=25385 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105418.304:408): user pid=25385 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105418.304:409): user pid=25385 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.305:410): user pid=25388 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25388 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.305:411): user pid=25388 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25388 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105418.307:412): user pid=25388 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105418.352:413): user pid=25385 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105418.352:414): user pid=25385 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105418.353:415): user pid=25385 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105418.354:416): user pid=25385 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.354:417): user pid=25385 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25385 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.354:418): user pid=25385 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25385 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105418.354:419): user pid=25385 uid=0 auid=0 ses=26 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25385 suid=0 rport=60017 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105419.993:420): user pid=25398 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25398 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105419.993:421): user pid=25398 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25398 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105419.993:422): user pid=25397 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25398 suid=74 rport=60025 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105419.994:423): user pid=25397 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25398 suid=74 rport=60025 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105420.055:424): user pid=25397 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60025 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105420.055:425): user pid=25397 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60025 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105420.061:426): user pid=25397 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105420.062:427): user pid=25397 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25398 suid=74 rport=60025 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105420.062:428): user pid=25397 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105420.063:429): user pid=25397 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105420.063:430): pid=25397 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=27 >type=USER_ROLE_CHANGE msg=audit(1406105420.134:431): user pid=25397 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105420.145:432): user pid=25397 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105420.149:433): user pid=25397 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105420.150:434): user pid=25397 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105420.151:435): user pid=25400 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25400 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105420.151:436): user pid=25400 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25400 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105420.152:437): user pid=25400 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=ADD_GROUP msg=audit(1406105453.526:438): user pid=25414 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=52 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406105453.594:439): user pid=25414 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=52 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406105453.594:440): user pid=25414 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=52 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_USER msg=audit(1406105453.686:441): user pid=25419 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=52 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406105458.592:442): user pid=25397 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105458.592:443): user pid=25397 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105458.595:444): user pid=25397 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105458.595:445): user pid=25397 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105458.596:446): user pid=25397 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25397 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105458.596:447): user pid=25397 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25397 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105458.596:448): user pid=25397 uid=0 auid=0 ses=27 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25397 suid=0 rport=60025 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.054:449): user pid=25431 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25431 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.054:450): user pid=25431 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25431 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105505.055:451): user pid=25430 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25431 suid=74 rport=60048 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105505.055:452): user pid=25430 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25431 suid=74 rport=60048 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105505.116:453): user pid=25430 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60048 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105505.116:454): user pid=25430 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60048 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105505.123:455): user pid=25430 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.124:456): user pid=25430 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25431 suid=74 rport=60048 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105505.125:457): user pid=25430 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105505.126:458): user pid=25430 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105505.126:459): pid=25430 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=28 >type=USER_ROLE_CHANGE msg=audit(1406105505.201:460): user pid=25430 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105505.214:461): user pid=25430 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105505.217:462): user pid=25430 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105505.218:463): user pid=25430 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.219:464): user pid=25433 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25433 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.219:465): user pid=25433 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25433 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105505.221:466): user pid=25433 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105505.271:467): user pid=25430 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105505.271:468): user pid=25430 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105505.272:469): user pid=25430 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105505.273:470): user pid=25430 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.274:471): user pid=25430 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25430 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.274:472): user pid=25430 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25430 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.274:473): user pid=25430 uid=0 auid=0 ses=28 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25430 suid=0 rport=60048 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.284:474): user pid=25443 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25443 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.284:475): user pid=25443 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25443 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105505.285:476): user pid=25442 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25443 suid=74 rport=60049 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105505.285:477): user pid=25442 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25443 suid=74 rport=60049 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105505.344:478): user pid=25442 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60049 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105505.344:479): user pid=25442 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60049 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105505.351:480): user pid=25442 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.351:481): user pid=25442 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25443 suid=74 rport=60049 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105505.352:482): user pid=25442 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105505.353:483): user pid=25442 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105505.353:484): pid=25442 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=29 >type=USER_ROLE_CHANGE msg=audit(1406105505.428:485): user pid=25442 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105505.440:486): user pid=25442 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105505.442:487): user pid=25442 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105505.442:488): user pid=25442 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.443:489): user pid=25445 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25445 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.443:490): user pid=25445 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25445 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105505.445:491): user pid=25445 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105505.585:492): user pid=25442 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105505.586:493): user pid=25442 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105505.587:494): user pid=25442 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105505.587:495): user pid=25442 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.588:496): user pid=25442 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25442 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.588:497): user pid=25442 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25442 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105505.588:498): user pid=25442 uid=0 auid=0 ses=29 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25442 suid=0 rport=60049 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105506.753:499): user pid=25455 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25455 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105506.753:500): user pid=25455 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25455 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105506.754:501): user pid=25454 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25455 suid=74 rport=60054 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105506.754:502): user pid=25454 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25455 suid=74 rport=60054 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105506.815:503): user pid=25454 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60054 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105506.815:504): user pid=25454 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60054 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105506.822:505): user pid=25454 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105506.822:506): user pid=25454 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25455 suid=74 rport=60054 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105506.823:507): user pid=25454 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105506.823:508): user pid=25454 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105506.824:509): pid=25454 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=30 >type=USER_ROLE_CHANGE msg=audit(1406105506.895:510): user pid=25454 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105506.905:511): user pid=25454 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105506.907:512): user pid=25454 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105506.908:513): user pid=25454 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105506.909:514): user pid=25457 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25457 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105506.909:515): user pid=25457 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25457 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105506.910:516): user pid=25457 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105506.960:517): user pid=25454 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105506.960:518): user pid=25454 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105506.961:519): user pid=25454 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105506.962:520): user pid=25454 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105506.962:521): user pid=25454 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25454 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105506.962:522): user pid=25454 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25454 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105506.962:523): user pid=25454 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25454 suid=0 rport=60054 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105507.465:524): user pid=25512 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25512 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105507.465:525): user pid=25512 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25512 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105507.465:526): user pid=25508 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25512 suid=74 rport=60057 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105507.465:527): user pid=25508 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25512 suid=74 rport=60057 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105507.524:528): user pid=25508 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60057 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105507.524:529): user pid=25508 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60057 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105507.531:530): user pid=25508 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105507.531:531): user pid=25508 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25512 suid=74 rport=60057 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105507.532:532): user pid=25508 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105507.535:533): user pid=25508 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105507.535:534): pid=25508 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=31 >type=USER_ROLE_CHANGE msg=audit(1406105507.618:535): user pid=25508 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105507.627:536): user pid=25508 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105507.630:537): user pid=25508 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105507.631:538): user pid=25508 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105507.632:539): user pid=25603 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25603 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105507.633:540): user pid=25603 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25603 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105507.634:541): user pid=25603 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105507.670:542): user pid=25508 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105507.671:543): user pid=25508 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105507.672:544): user pid=25508 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105507.672:545): user pid=25508 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105507.673:546): user pid=25508 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25508 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105507.673:547): user pid=25508 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25508 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105507.673:548): user pid=25508 uid=0 auid=0 ses=31 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25508 suid=0 rport=60057 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105517.099:549): user pid=25780 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25780 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105517.099:550): user pid=25780 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25780 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105517.099:551): user pid=25779 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25780 suid=74 rport=60084 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105517.099:552): user pid=25779 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25780 suid=74 rport=60084 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105517.158:553): user pid=25779 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60084 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105517.158:554): user pid=25779 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60084 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105517.163:555): user pid=25779 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105517.163:556): user pid=25779 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25780 suid=74 rport=60084 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105517.164:557): user pid=25779 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105517.165:558): user pid=25779 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105517.165:559): pid=25779 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=32 >type=USER_ROLE_CHANGE msg=audit(1406105517.233:560): user pid=25779 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105517.245:561): user pid=25779 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105517.247:562): user pid=25779 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105517.247:563): user pid=25779 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105517.248:564): user pid=25782 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25782 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105517.248:565): user pid=25782 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25782 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105517.249:566): user pid=25782 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105517.278:567): user pid=25779 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105517.279:568): user pid=25779 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105517.279:569): user pid=25779 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105517.280:570): user pid=25779 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105517.280:571): user pid=25779 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25779 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105517.280:572): user pid=25779 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25779 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105517.280:573): user pid=25779 uid=0 auid=0 ses=32 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25779 suid=0 rport=60084 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=ADD_GROUP msg=audit(1406105522.128:574): user pid=25792 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=499 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406105522.195:575): user pid=25792 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=499 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406105522.195:576): user pid=25792 uid=0 auid=0 ses=30 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=499 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105526.743:577): user pid=25805 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25805 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105526.743:578): user pid=25805 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25805 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105526.744:579): user pid=25804 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25805 suid=74 rport=60095 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105526.744:580): user pid=25804 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25805 suid=74 rport=60095 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105526.816:581): user pid=25804 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60095 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105526.816:582): user pid=25804 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60095 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105526.821:583): user pid=25804 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105526.822:584): user pid=25804 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25805 suid=74 rport=60095 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105526.822:585): user pid=25804 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105526.823:586): user pid=25804 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105526.823:587): pid=25804 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=33 >type=USER_ROLE_CHANGE msg=audit(1406105526.905:588): user pid=25804 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105526.918:589): user pid=25804 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105526.923:590): user pid=25804 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105526.923:591): user pid=25804 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105526.924:592): user pid=25807 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25807 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105526.924:593): user pid=25807 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25807 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105526.925:594): user pid=25807 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105526.959:595): user pid=25804 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105526.959:596): user pid=25804 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105526.960:597): user pid=25804 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105526.960:598): user pid=25804 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105526.960:599): user pid=25804 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25804 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105526.960:600): user pid=25804 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25804 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105526.960:601): user pid=25804 uid=0 auid=0 ses=33 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25804 suid=0 rport=60095 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105536.358:602): user pid=25815 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25815 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105536.358:603): user pid=25815 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25815 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105536.360:604): user pid=25814 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25815 suid=74 rport=60098 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105536.360:605): user pid=25814 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25815 suid=74 rport=60098 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105536.417:606): user pid=25814 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60098 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105536.417:607): user pid=25814 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60098 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105536.423:608): user pid=25814 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105536.423:609): user pid=25814 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25815 suid=74 rport=60098 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105536.423:610): user pid=25814 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105536.424:611): user pid=25814 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105536.424:612): pid=25814 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=34 >type=USER_ROLE_CHANGE msg=audit(1406105536.498:613): user pid=25814 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105536.509:614): user pid=25814 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105536.511:615): user pid=25814 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105536.511:616): user pid=25814 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105536.512:617): user pid=25817 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25817 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105536.512:618): user pid=25817 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25817 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105536.512:619): user pid=25817 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105536.541:620): user pid=25814 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105536.542:621): user pid=25814 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105536.542:622): user pid=25814 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105536.543:623): user pid=25814 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105536.543:624): user pid=25814 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25814 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105536.543:625): user pid=25814 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25814 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105536.543:626): user pid=25814 uid=0 auid=0 ses=34 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25814 suid=0 rport=60098 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105545.973:627): user pid=25829 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25829 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105545.973:628): user pid=25829 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25829 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105545.973:629): user pid=25828 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25829 suid=74 rport=60101 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105545.973:630): user pid=25828 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25829 suid=74 rport=60101 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105546.030:631): user pid=25828 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60101 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105546.030:632): user pid=25828 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60101 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105546.036:633): user pid=25828 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105546.036:634): user pid=25828 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25829 suid=74 rport=60101 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105546.036:635): user pid=25828 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105546.037:636): user pid=25828 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105546.037:637): pid=25828 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=35 >type=USER_ROLE_CHANGE msg=audit(1406105546.112:638): user pid=25828 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105546.123:639): user pid=25828 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105546.125:640): user pid=25828 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105546.126:641): user pid=25828 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105546.126:642): user pid=25831 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25831 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105546.126:643): user pid=25831 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25831 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105546.127:644): user pid=25831 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105546.160:645): user pid=25828 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105546.160:646): user pid=25828 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105546.162:647): user pid=25828 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105546.162:648): user pid=25828 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105546.162:649): user pid=25828 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25828 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105546.162:650): user pid=25828 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25828 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105546.162:651): user pid=25828 uid=0 auid=0 ses=35 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25828 suid=0 rport=60101 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105555.564:652): user pid=25839 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25839 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105555.564:653): user pid=25839 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25839 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105555.565:654): user pid=25838 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25839 suid=74 rport=60104 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105555.565:655): user pid=25838 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25839 suid=74 rport=60104 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105555.625:656): user pid=25838 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60104 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105555.625:657): user pid=25838 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60104 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105555.632:658): user pid=25838 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105555.632:659): user pid=25838 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25839 suid=74 rport=60104 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105555.633:660): user pid=25838 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105555.634:661): user pid=25838 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105555.634:662): pid=25838 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=36 >type=USER_ROLE_CHANGE msg=audit(1406105555.707:663): user pid=25838 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105555.717:664): user pid=25838 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105555.720:665): user pid=25838 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105555.720:666): user pid=25838 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105555.722:667): user pid=25841 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25841 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105555.722:668): user pid=25841 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25841 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105555.723:669): user pid=25841 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105555.767:670): user pid=25838 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105555.767:671): user pid=25838 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105555.768:672): user pid=25838 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105555.769:673): user pid=25838 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105555.769:674): user pid=25838 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25838 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105555.769:675): user pid=25838 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25838 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105555.769:676): user pid=25838 uid=0 auid=0 ses=36 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25838 suid=0 rport=60104 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105565.158:677): user pid=25851 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25851 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105565.158:678): user pid=25851 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25851 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105565.158:679): user pid=25850 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25851 suid=74 rport=60107 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105565.158:680): user pid=25850 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25851 suid=74 rport=60107 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105565.215:681): user pid=25850 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60107 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105565.215:682): user pid=25850 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60107 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105565.219:683): user pid=25850 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105565.220:684): user pid=25850 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25851 suid=74 rport=60107 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105565.220:685): user pid=25850 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105565.221:686): user pid=25850 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105565.221:687): pid=25850 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=37 >type=USER_ROLE_CHANGE msg=audit(1406105565.285:688): user pid=25850 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105565.293:689): user pid=25850 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105565.293:690): user pid=25850 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105565.294:691): user pid=25850 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105565.294:692): user pid=25853 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25853 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105565.295:693): user pid=25853 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25853 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105565.295:694): user pid=25853 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105565.325:695): user pid=25850 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105565.326:696): user pid=25850 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105565.327:697): user pid=25850 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105565.327:698): user pid=25850 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105565.327:699): user pid=25850 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25850 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105565.327:700): user pid=25850 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25850 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105565.327:701): user pid=25850 uid=0 auid=0 ses=37 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25850 suid=0 rport=60107 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=MAC_POLICY_LOAD msg=audit(1406105574.009:702): policy loaded auid=0 ses=30 >type=SYSCALL msg=audit(1406105574.009:702): arch=c000003e syscall=1 success=yes exit=7322487 a0=4 a1=7fa56a075000 a2=6fbb77 a3=7fff01267880 items=0 ppid=25848 pid=25862 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=30 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null) >type=CRYPTO_KEY_USER msg=audit(1406105574.914:703): user pid=25864 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25864 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105574.914:704): user pid=25864 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25864 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105574.915:705): user pid=25863 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25864 suid=74 rport=60110 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105574.916:706): user pid=25863 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25864 suid=74 rport=60110 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105574.978:707): user pid=25863 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60110 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105574.978:708): user pid=25863 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60110 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105574.983:709): user pid=25863 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105574.983:710): user pid=25863 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25864 suid=74 rport=60110 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105574.983:711): user pid=25863 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105574.984:712): user pid=25863 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105574.984:713): pid=25863 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=38 >type=USER_ROLE_CHANGE msg=audit(1406105575.057:714): user pid=25863 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105575.066:715): user pid=25863 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105575.068:716): user pid=25863 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105575.068:717): user pid=25863 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105575.069:718): user pid=25867 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25867 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105575.069:719): user pid=25867 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25867 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105575.070:720): user pid=25867 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105575.100:721): user pid=25863 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105575.101:722): user pid=25863 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105575.101:723): user pid=25863 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105575.102:724): user pid=25863 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105575.102:725): user pid=25863 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25863 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105575.102:726): user pid=25863 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25863 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105575.102:727): user pid=25863 uid=0 auid=0 ses=38 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25863 suid=0 rport=60110 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=MAC_POLICY_LOAD msg=audit(1406105578.460:728): policy loaded auid=0 ses=30 >type=SYSCALL msg=audit(1406105578.460:728): arch=c000003e syscall=1 success=yes exit=7322487 a0=4 a1=7fd17b3f8000 a2=6fbb77 a3=7fffbe0147b0 items=0 ppid=25865 pid=25874 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=30 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null) >type=MAC_POLICY_LOAD msg=audit(1406105583.356:729): policy loaded auid=0 ses=30 >type=SYSCALL msg=audit(1406105583.356:729): arch=c000003e syscall=1 success=yes exit=7322487 a0=4 a1=7f41e75b2000 a2=6fbb77 a3=7fff25d83500 items=0 ppid=25876 pid=25877 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=30 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null) >type=CRYPTO_KEY_USER msg=audit(1406105584.585:730): user pid=25880 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25880 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105584.585:731): user pid=25880 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25880 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105584.586:732): user pid=25879 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25880 suid=74 rport=60113 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105584.586:733): user pid=25879 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25880 suid=74 rport=60113 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105584.644:734): user pid=25879 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60113 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105584.644:735): user pid=25879 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60113 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105584.650:736): user pid=25879 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105584.650:737): user pid=25879 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25880 suid=74 rport=60113 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105584.651:738): user pid=25879 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105584.652:739): user pid=25879 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105584.652:740): pid=25879 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=39 >type=USER_ROLE_CHANGE msg=audit(1406105584.732:741): user pid=25879 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105584.746:742): user pid=25879 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105584.746:743): user pid=25879 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105584.747:744): user pid=25879 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105584.748:745): user pid=25883 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25883 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105584.748:746): user pid=25883 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25883 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105584.750:747): user pid=25883 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105584.780:748): user pid=25879 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105584.780:749): user pid=25879 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105584.781:750): user pid=25879 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105584.781:751): user pid=25879 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105584.781:752): user pid=25879 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25879 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105584.782:753): user pid=25879 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25879 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105584.782:754): user pid=25879 uid=0 auid=0 ses=39 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25879 suid=0 rport=60113 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=MAC_POLICY_LOAD msg=audit(1406105588.240:755): policy loaded auid=0 ses=30 >type=SYSCALL msg=audit(1406105588.240:755): arch=c000003e syscall=1 success=yes exit=7322487 a0=4 a1=7f071c16f000 a2=6fbb77 a3=7fff154dca20 items=0 ppid=25882 pid=25890 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=30 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null) >type=CRYPTO_KEY_USER msg=audit(1406105594.251:756): user pid=25894 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25894 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105594.251:757): user pid=25894 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25894 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105594.253:758): user pid=25893 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25894 suid=74 rport=60116 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105594.253:759): user pid=25893 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25894 suid=74 rport=60116 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105594.312:760): user pid=25893 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60116 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105594.312:761): user pid=25893 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60116 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105594.321:762): user pid=25893 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105594.321:763): user pid=25893 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25894 suid=74 rport=60116 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105594.322:764): user pid=25893 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105594.322:765): user pid=25893 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105594.322:766): pid=25893 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=40 >type=USER_ROLE_CHANGE msg=audit(1406105594.399:767): user pid=25893 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105594.409:768): user pid=25893 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105594.411:769): user pid=25893 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105594.411:770): user pid=25893 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105594.411:771): user pid=25896 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25896 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105594.412:772): user pid=25896 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25896 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105594.412:773): user pid=25896 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105594.443:774): user pid=25893 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105594.443:775): user pid=25893 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105594.444:776): user pid=25893 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105594.444:777): user pid=25893 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105594.444:778): user pid=25893 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25893 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105594.444:779): user pid=25893 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25893 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105594.444:780): user pid=25893 uid=0 auid=0 ses=40 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25893 suid=0 rport=60116 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105603.848:781): user pid=25906 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25906 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105603.848:782): user pid=25906 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25906 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105603.848:783): user pid=25905 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25906 suid=74 rport=60119 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105603.848:784): user pid=25905 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25906 suid=74 rport=60119 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105603.904:785): user pid=25905 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60119 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105603.905:786): user pid=25905 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60119 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105603.909:787): user pid=25905 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105603.910:788): user pid=25905 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25906 suid=74 rport=60119 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105603.910:789): user pid=25905 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105603.911:790): user pid=25905 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105603.911:791): pid=25905 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=41 >type=USER_ROLE_CHANGE msg=audit(1406105603.976:792): user pid=25905 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105603.987:793): user pid=25905 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105603.989:794): user pid=25905 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105603.990:795): user pid=25905 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105603.990:796): user pid=25908 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25908 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105603.990:797): user pid=25908 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25908 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105603.991:798): user pid=25908 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105604.020:799): user pid=25905 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105604.023:800): user pid=25905 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105604.024:801): user pid=25905 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105604.025:802): user pid=25905 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105604.025:803): user pid=25905 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25905 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105604.025:804): user pid=25905 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25905 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105604.025:805): user pid=25905 uid=0 auid=0 ses=41 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25905 suid=0 rport=60119 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=MAC_CONFIG_CHANGE msg=audit(1406105607.127:806): bool=virt_use_fusefs val=1 old_val=0 auid=0 ses=30 >type=SYSCALL msg=audit(1406105607.127:806): arch=c000003e syscall=1 success=yes exit=2 a0=4 a1=7fffec9329a0 a2=2 a3=0 items=0 ppid=25848 pid=25892 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=30 comm="setsebool" exe="/usr/sbin/setsebool" subj=unconfined_u:system_r:setsebool_t:s0-s0:c0.c1023 key=(null) >type=CRYPTO_KEY_USER msg=audit(1406105610.525:807): user pid=25918 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25918 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105610.525:808): user pid=25918 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25918 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105610.527:809): user pid=25917 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25918 suid=74 rport=60134 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105610.528:810): user pid=25917 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25918 suid=74 rport=60134 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105610.593:811): user pid=25917 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60134 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105610.593:812): user pid=25917 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60134 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105610.599:813): user pid=25917 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105610.600:814): user pid=25917 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25918 suid=74 rport=60134 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105610.600:815): user pid=25917 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105610.601:816): user pid=25917 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105610.601:817): pid=25917 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=42 >type=USER_ROLE_CHANGE msg=audit(1406105610.689:818): user pid=25917 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105610.700:819): user pid=25917 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105610.701:820): user pid=25917 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105610.701:821): user pid=25917 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105610.702:822): user pid=25920 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25920 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105610.702:823): user pid=25920 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25920 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105610.703:824): user pid=25920 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105610.734:825): user pid=25917 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105610.735:826): user pid=25917 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105610.735:827): user pid=25917 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105610.736:828): user pid=25917 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105610.736:829): user pid=25917 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25917 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105610.736:830): user pid=25917 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25917 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105610.736:831): user pid=25917 uid=0 auid=0 ses=42 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25917 suid=0 rport=60134 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105613.986:832): user pid=25942 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25942 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105613.986:833): user pid=25942 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25942 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105613.987:834): user pid=25941 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25942 suid=74 rport=60136 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105613.987:835): user pid=25941 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25942 suid=74 rport=60136 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105614.048:836): user pid=25941 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60136 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105614.048:837): user pid=25941 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60136 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105614.055:838): user pid=25941 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105614.055:839): user pid=25941 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25942 suid=74 rport=60136 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105614.056:840): user pid=25941 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105614.056:841): user pid=25941 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105614.056:842): pid=25941 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=43 >type=USER_ROLE_CHANGE msg=audit(1406105614.131:843): user pid=25941 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105614.138:844): user pid=25941 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105614.140:845): user pid=25941 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105614.140:846): user pid=25941 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105614.141:847): user pid=25973 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25973 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105614.141:848): user pid=25973 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25973 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105614.142:849): user pid=25973 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105614.171:850): user pid=25941 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105614.173:851): user pid=25941 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105614.174:852): user pid=25941 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105614.175:853): user pid=25941 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105614.175:854): user pid=25941 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25941 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105614.175:855): user pid=25941 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25941 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105614.175:856): user pid=25941 uid=0 auid=0 ses=43 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25941 suid=0 rport=60136 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105617.194:857): user pid=25995 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25995 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105617.194:858): user pid=25995 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25995 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105617.195:859): user pid=25994 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=25995 suid=74 rport=60137 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406105617.195:860): user pid=25994 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=25995 suid=74 rport=60137 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105617.255:861): user pid=25994 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60137 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105617.255:862): user pid=25994 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60137 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406105617.262:863): user pid=25994 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105617.262:864): user pid=25994 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25995 suid=74 rport=60137 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406105617.263:865): user pid=25994 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406105617.263:866): user pid=25994 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406105617.263:867): pid=25994 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=44 >type=USER_ROLE_CHANGE msg=audit(1406105617.337:868): user pid=25994 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105617.347:869): user pid=25994 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406105617.349:870): user pid=25994 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406105617.350:871): user pid=25994 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105617.350:872): user pid=25997 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25997 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105617.351:873): user pid=25997 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25997 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406105617.352:874): user pid=25997 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105617.401:875): user pid=25994 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406105617.402:876): user pid=25994 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406105617.403:877): user pid=25994 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406105617.404:878): user pid=25994 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406105617.404:879): user pid=25994 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=25994 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105617.404:880): user pid=25994 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=25994 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406105617.404:881): user pid=25994 uid=0 auid=0 ses=44 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=25994 suid=0 rport=60137 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106001.118:882): user pid=26004 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406106001.118:883): user pid=26004 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406106001.120:884): pid=26004 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=45 >type=USER_START msg=audit(1406106001.127:885): user pid=26004 uid=0 auid=0 ses=45 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406106001.208:886): user pid=26004 uid=0 auid=0 ses=45 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406106001.208:887): user pid=26004 uid=0 auid=0 ses=45 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRYPTO_KEY_USER msg=audit(1406106022.415:888): user pid=26009 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26009 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106022.415:889): user pid=26009 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26009 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106022.416:890): user pid=26008 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26009 suid=74 rport=60836 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106022.416:891): user pid=26008 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26009 suid=74 rport=60836 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106022.478:892): user pid=26008 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60836 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106022.478:893): user pid=26008 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60836 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106022.485:894): user pid=26008 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106022.485:895): user pid=26008 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26009 suid=74 rport=60836 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106022.486:896): user pid=26008 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106022.487:897): user pid=26008 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106022.487:898): pid=26008 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=46 >type=USER_ROLE_CHANGE msg=audit(1406106022.558:899): user pid=26008 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106022.569:900): user pid=26008 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106022.572:901): user pid=26008 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106022.572:902): user pid=26008 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106022.573:903): user pid=26011 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26011 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106022.573:904): user pid=26011 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26011 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106022.575:905): user pid=26011 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106022.621:906): user pid=26008 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106022.622:907): user pid=26008 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106022.622:908): user pid=26008 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106022.623:909): user pid=26008 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106022.623:910): user pid=26008 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26008 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106022.623:911): user pid=26008 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26008 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106022.623:912): user pid=26008 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26008 suid=0 rport=60836 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106031.752:913): user pid=26320 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26320 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106031.752:914): user pid=26320 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26320 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106031.752:915): user pid=26319 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26320 suid=74 rport=60865 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106031.752:916): user pid=26319 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26320 suid=74 rport=60865 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106031.815:917): user pid=26319 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60865 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106031.815:918): user pid=26319 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60865 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106031.820:919): user pid=26319 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106031.820:920): user pid=26319 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26320 suid=74 rport=60865 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106031.820:921): user pid=26319 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106031.821:922): user pid=26319 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106031.821:923): pid=26319 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=47 >type=USER_ROLE_CHANGE msg=audit(1406106031.894:924): user pid=26319 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106031.903:925): user pid=26319 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106031.905:926): user pid=26319 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106031.905:927): user pid=26319 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106031.906:928): user pid=26322 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26322 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106031.906:929): user pid=26322 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26322 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106031.911:930): user pid=26322 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106031.944:931): user pid=26319 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106031.946:932): user pid=26319 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106031.947:933): user pid=26319 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106031.948:934): user pid=26319 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106031.948:935): user pid=26319 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26319 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106031.948:936): user pid=26319 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26319 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106031.948:937): user pid=26319 uid=0 auid=0 ses=47 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26319 suid=0 rport=60865 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106047.895:938): user pid=26334 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26334 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106047.895:939): user pid=26334 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26334 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106047.896:940): user pid=26333 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26334 suid=74 rport=60897 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106047.896:941): user pid=26333 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26334 suid=74 rport=60897 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106047.963:942): user pid=26333 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60897 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106047.963:943): user pid=26333 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60897 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106047.969:944): user pid=26333 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106047.970:945): user pid=26333 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26334 suid=74 rport=60897 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106047.970:946): user pid=26333 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106047.971:947): user pid=26333 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106047.971:948): pid=26333 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=48 >type=USER_ROLE_CHANGE msg=audit(1406106048.039:949): user pid=26333 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106048.051:950): user pid=26333 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106048.053:951): user pid=26333 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106048.053:952): user pid=26333 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106048.054:953): user pid=26336 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26336 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106048.054:954): user pid=26336 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26336 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106048.056:955): user pid=26336 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106048.101:956): user pid=26333 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106048.103:957): user pid=26333 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106048.105:958): user pid=26333 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106048.107:959): user pid=26333 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106048.107:960): user pid=26333 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26333 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106048.107:961): user pid=26333 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26333 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106048.107:962): user pid=26333 uid=0 auid=0 ses=48 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26333 suid=0 rport=60897 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=ADD_GROUP msg=audit(1406106054.534:963): user pid=26356 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=36 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406106054.593:964): user pid=26356 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=36 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406106054.593:965): user pid=26356 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=36 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406106054.677:966): user pid=26361 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=107 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406106054.752:967): user pid=26361 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=107 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406106054.753:968): user pid=26361 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=107 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_USER msg=audit(1406106054.845:969): user pid=26366 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=107 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' >type=ADD_USER msg=audit(1406106054.845:970): user pid=26366 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to group acct="qemu" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' >type=ADD_USER msg=audit(1406106054.846:971): user pid=26366 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to shadow group acct="qemu" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406106058.977:972): table=filter family=2 entries=0 >type=SYSCALL msg=audit(1406106058.977:972): arch=c000003e syscall=175 success=yes exit=0 a0=1cff220 a1=22a0 a2=1cf74e0 a3=7fffc2747070 items=0 ppid=26388 pid=26389 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/sbin/modprobe" subj=system_u:system_r:insmod_t:s0 key=(null) >type=NETFILTER_CFG msg=audit(1406106058.978:973): table=filter family=2 entries=4 >type=SYSCALL msg=audit(1406106058.978:973): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=13222c0 items=0 ppid=26022 pid=26384 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) >type=USER_ACCT msg=audit(1406106061.229:974): user pid=26424 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406106061.229:975): user pid=26424 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406106061.234:976): pid=26424 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=49 >type=USER_START msg=audit(1406106061.245:977): user pid=26424 uid=0 auid=0 ses=49 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406106061.270:978): user pid=26424 uid=0 auid=0 ses=49 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406106061.270:979): user pid=26424 uid=0 auid=0 ses=49 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRYPTO_KEY_USER msg=audit(1406106064.072:980): user pid=26438 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26438 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106064.072:981): user pid=26438 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26438 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106064.075:982): user pid=26437 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26438 suid=74 rport=60952 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106064.075:983): user pid=26437 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26438 suid=74 rport=60952 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106064.143:984): user pid=26437 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60952 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106064.143:985): user pid=26437 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60952 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106064.150:986): user pid=26437 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106064.150:987): user pid=26437 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26438 suid=74 rport=60952 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106064.151:988): user pid=26437 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106064.152:989): user pid=26437 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106064.152:990): pid=26437 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=50 >type=USER_ROLE_CHANGE msg=audit(1406106064.231:991): user pid=26437 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106064.243:992): user pid=26437 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106064.246:993): user pid=26437 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106064.248:994): user pid=26437 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106064.249:995): user pid=26440 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26440 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106064.249:996): user pid=26440 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26440 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106064.251:997): user pid=26440 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106064.289:998): user pid=26437 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106064.289:999): user pid=26437 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106064.290:1000): user pid=26437 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106064.290:1001): user pid=26437 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106064.291:1002): user pid=26437 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26437 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106064.291:1003): user pid=26437 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26437 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106064.291:1004): user pid=26437 uid=0 auid=0 ses=50 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26437 suid=0 rport=60952 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106080.287:1005): user pid=26454 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26454 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106080.287:1006): user pid=26454 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26454 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106080.288:1007): user pid=26453 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26454 suid=74 rport=60984 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106080.289:1008): user pid=26453 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26454 suid=74 rport=60984 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106080.350:1009): user pid=26453 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=60984 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106080.350:1010): user pid=26453 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=60984 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106080.358:1011): user pid=26453 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106080.358:1012): user pid=26453 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26454 suid=74 rport=60984 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106080.359:1013): user pid=26453 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106080.359:1014): user pid=26453 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106080.360:1015): pid=26453 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=51 >type=USER_ROLE_CHANGE msg=audit(1406106080.434:1016): user pid=26453 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106080.443:1017): user pid=26453 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106080.446:1018): user pid=26453 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106080.446:1019): user pid=26453 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106080.447:1020): user pid=26456 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26456 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106080.447:1021): user pid=26456 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26456 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106080.448:1022): user pid=26456 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106080.478:1023): user pid=26453 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106080.479:1024): user pid=26453 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106080.480:1025): user pid=26453 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106080.480:1026): user pid=26453 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106080.480:1027): user pid=26453 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26453 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106080.480:1028): user pid=26453 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26453 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106080.480:1029): user pid=26453 uid=0 auid=0 ses=51 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26453 suid=0 rport=60984 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406106091.002:1030): table=filter family=2 entries=5 >type=SYSCALL msg=audit(1406106091.002:1030): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=12c59b0 items=0 ppid=26022 pid=26467 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106091.456:1031): table=filter family=2 entries=6 >type=SYSCALL msg=audit(1406106091.456:1031): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=976e10 items=0 ppid=26022 pid=26500 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) >type=CRYPTO_KEY_USER msg=audit(1406106096.467:1032): user pid=26533 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26533 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106096.467:1033): user pid=26533 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26533 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106096.467:1034): user pid=26532 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26533 suid=74 rport=32784 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106096.468:1035): user pid=26532 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26533 suid=74 rport=32784 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106096.559:1036): user pid=26532 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32784 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106096.559:1037): user pid=26532 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32784 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106096.567:1038): user pid=26532 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106096.567:1039): user pid=26532 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26533 suid=74 rport=32784 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106096.568:1040): user pid=26532 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106096.570:1041): user pid=26532 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106096.570:1042): pid=26532 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=52 >type=USER_ROLE_CHANGE msg=audit(1406106096.645:1043): user pid=26532 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106096.659:1044): user pid=26532 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106096.661:1045): user pid=26532 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106096.662:1046): user pid=26532 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106096.663:1047): user pid=26535 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26535 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106096.663:1048): user pid=26535 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26535 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106096.664:1049): user pid=26535 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106096.707:1050): user pid=26532 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106096.708:1051): user pid=26532 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106096.709:1052): user pid=26532 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106096.709:1053): user pid=26532 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106096.710:1054): user pid=26532 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26532 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106096.710:1055): user pid=26532 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26532 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106096.710:1056): user pid=26532 uid=0 auid=0 ses=52 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26532 suid=0 rport=32784 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=ADD_GROUP msg=audit(1406106108.014:1057): user pid=26557 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=75 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406106108.065:1058): user pid=26557 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=75 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406106108.065:1059): user pid=26557 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=75 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_USER msg=audit(1406106108.150:1060): user pid=26562 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=75 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106112.695:1061): user pid=26600 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26600 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106112.695:1062): user pid=26600 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26600 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106112.697:1063): user pid=26599 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26600 suid=74 rport=32816 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106112.697:1064): user pid=26599 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26600 suid=74 rport=32816 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106112.759:1065): user pid=26599 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32816 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106112.759:1066): user pid=26599 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32816 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106112.766:1067): user pid=26599 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106112.767:1068): user pid=26599 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26600 suid=74 rport=32816 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106112.767:1069): user pid=26599 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106112.768:1070): user pid=26599 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106112.768:1071): pid=26599 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=53 >type=USER_ROLE_CHANGE msg=audit(1406106112.852:1072): user pid=26599 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106112.865:1073): user pid=26599 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106112.867:1074): user pid=26599 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106112.868:1075): user pid=26599 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106112.868:1076): user pid=26609 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26609 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106112.869:1077): user pid=26609 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26609 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106112.870:1078): user pid=26609 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106112.900:1079): user pid=26599 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106112.901:1080): user pid=26599 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106112.902:1081): user pid=26599 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106112.902:1082): user pid=26599 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106112.902:1083): user pid=26599 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26599 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106112.902:1084): user pid=26599 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26599 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106112.902:1085): user pid=26599 uid=0 auid=0 ses=53 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26599 suid=0 rport=32816 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106128.855:1086): user pid=26623 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26623 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106128.856:1087): user pid=26623 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26623 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106128.856:1088): user pid=26622 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26623 suid=74 rport=32869 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106128.856:1089): user pid=26622 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26623 suid=74 rport=32869 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106128.926:1090): user pid=26622 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32869 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106128.926:1091): user pid=26622 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32869 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106128.933:1092): user pid=26622 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106128.933:1093): user pid=26622 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26623 suid=74 rport=32869 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106128.934:1094): user pid=26622 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106128.935:1095): user pid=26622 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106128.935:1096): pid=26622 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=54 >type=USER_ROLE_CHANGE msg=audit(1406106129.007:1097): user pid=26622 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106129.016:1098): user pid=26622 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106129.019:1099): user pid=26622 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106129.020:1100): user pid=26622 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106129.021:1101): user pid=26625 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26625 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106129.021:1102): user pid=26625 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26625 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106129.022:1103): user pid=26625 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106129.068:1104): user pid=26622 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106129.069:1105): user pid=26622 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106129.069:1106): user pid=26622 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106129.070:1107): user pid=26622 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106129.070:1108): user pid=26622 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26622 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106129.070:1109): user pid=26622 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26622 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106129.070:1110): user pid=26622 uid=0 auid=0 ses=54 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26622 suid=0 rport=32869 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106142.263:1111): user pid=26633 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26633 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106142.263:1112): user pid=26633 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26633 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106142.264:1113): user pid=26632 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26633 suid=74 rport=32883 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106142.264:1114): user pid=26632 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26633 suid=74 rport=32883 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106142.328:1115): user pid=26632 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32883 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106142.328:1116): user pid=26632 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32883 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106142.333:1117): user pid=26632 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106142.334:1118): user pid=26632 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26633 suid=74 rport=32883 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106142.335:1119): user pid=26632 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106142.335:1120): user pid=26632 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106142.336:1121): pid=26632 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=55 >type=USER_ROLE_CHANGE msg=audit(1406106142.407:1122): user pid=26632 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106142.419:1123): user pid=26632 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106142.420:1124): user pid=26632 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106142.421:1125): user pid=26632 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106142.421:1126): user pid=26635 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26635 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106142.421:1127): user pid=26635 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26635 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106142.422:1128): user pid=26635 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106142.458:1129): user pid=26632 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106142.458:1130): user pid=26632 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106142.459:1131): user pid=26632 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106142.459:1132): user pid=26632 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106142.459:1133): user pid=26632 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26632 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106142.460:1134): user pid=26632 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26632 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106142.460:1135): user pid=26632 uid=0 auid=0 ses=55 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26632 suid=0 rport=32883 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106151.923:1136): user pid=26643 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26643 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106151.923:1137): user pid=26643 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26643 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106151.923:1138): user pid=26642 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26643 suid=74 rport=32917 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106151.923:1139): user pid=26642 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26643 suid=74 rport=32917 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106152.004:1140): user pid=26642 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32917 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106152.004:1141): user pid=26642 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32917 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106152.011:1142): user pid=26642 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106152.011:1143): user pid=26642 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26643 suid=74 rport=32917 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106152.012:1144): user pid=26642 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106152.013:1145): user pid=26642 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106152.013:1146): pid=26642 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=56 >type=USER_ROLE_CHANGE msg=audit(1406106152.084:1147): user pid=26642 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106152.104:1148): user pid=26642 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106152.107:1149): user pid=26642 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106152.107:1150): user pid=26642 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106152.108:1151): user pid=26645 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26645 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106152.108:1152): user pid=26645 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26645 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106152.110:1153): user pid=26645 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106152.167:1154): user pid=26642 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106152.167:1155): user pid=26642 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106152.168:1156): user pid=26642 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106152.169:1157): user pid=26642 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106152.169:1158): user pid=26642 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26642 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106152.169:1159): user pid=26642 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26642 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106152.169:1160): user pid=26642 uid=0 auid=0 ses=56 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26642 suid=0 rport=32917 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106161.662:1161): user pid=26654 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26654 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106161.662:1162): user pid=26654 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26654 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106161.662:1163): user pid=26653 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26654 suid=74 rport=32951 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106161.662:1164): user pid=26653 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26654 suid=74 rport=32951 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106161.726:1165): user pid=26653 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32951 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106161.726:1166): user pid=26653 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32951 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106161.731:1167): user pid=26653 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106161.732:1168): user pid=26653 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26654 suid=74 rport=32951 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106161.732:1169): user pid=26653 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106161.733:1170): user pid=26653 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106161.733:1171): pid=26653 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=57 >type=USER_ROLE_CHANGE msg=audit(1406106161.805:1172): user pid=26653 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106161.818:1173): user pid=26653 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106161.819:1174): user pid=26653 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106161.819:1175): user pid=26653 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106161.820:1176): user pid=26656 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26656 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106161.820:1177): user pid=26656 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26656 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106161.821:1178): user pid=26656 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106161.853:1179): user pid=26653 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106161.853:1180): user pid=26653 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106161.854:1181): user pid=26653 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106161.855:1182): user pid=26653 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106161.855:1183): user pid=26653 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26653 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106161.855:1184): user pid=26653 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26653 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106161.855:1185): user pid=26653 uid=0 auid=0 ses=57 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26653 suid=0 rport=32951 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106171.383:1186): user pid=26666 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26666 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106171.383:1187): user pid=26666 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26666 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106171.385:1188): user pid=26665 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26666 suid=74 rport=32954 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106171.386:1189): user pid=26665 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26666 suid=74 rport=32954 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106171.450:1190): user pid=26665 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32954 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106171.450:1191): user pid=26665 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32954 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106171.456:1192): user pid=26665 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106171.456:1193): user pid=26665 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26666 suid=74 rport=32954 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106171.457:1194): user pid=26665 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106171.458:1195): user pid=26665 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106171.458:1196): pid=26665 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=58 >type=USER_ROLE_CHANGE msg=audit(1406106171.536:1197): user pid=26665 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106171.547:1198): user pid=26665 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106171.549:1199): user pid=26665 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106171.550:1200): user pid=26665 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106171.551:1201): user pid=26668 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26668 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106171.551:1202): user pid=26668 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26668 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106171.554:1203): user pid=26668 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106171.599:1204): user pid=26665 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106171.599:1205): user pid=26665 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106171.600:1206): user pid=26665 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106171.601:1207): user pid=26665 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106171.601:1208): user pid=26665 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26665 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106171.601:1209): user pid=26665 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26665 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106171.601:1210): user pid=26665 uid=0 auid=0 ses=58 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26665 suid=0 rport=32954 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106181.106:1211): user pid=26678 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26678 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106181.106:1212): user pid=26678 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26678 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106181.106:1213): user pid=26677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26678 suid=74 rport=32957 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106181.107:1214): user pid=26677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26678 suid=74 rport=32957 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106181.174:1215): user pid=26677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32957 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106181.174:1216): user pid=26677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32957 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106181.181:1217): user pid=26677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106181.181:1218): user pid=26677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26678 suid=74 rport=32957 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106181.182:1219): user pid=26677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106181.183:1220): user pid=26677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106181.183:1221): pid=26677 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=59 >type=USER_ROLE_CHANGE msg=audit(1406106181.257:1222): user pid=26677 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106181.267:1223): user pid=26677 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106181.269:1224): user pid=26677 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106181.270:1225): user pid=26677 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106181.270:1226): user pid=26680 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26680 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106181.271:1227): user pid=26680 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26680 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106181.272:1228): user pid=26680 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106181.309:1229): user pid=26677 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106181.310:1230): user pid=26677 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106181.311:1231): user pid=26677 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106181.312:1232): user pid=26677 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106181.312:1233): user pid=26677 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26677 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106181.312:1234): user pid=26677 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26677 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106181.312:1235): user pid=26677 uid=0 auid=0 ses=59 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26677 suid=0 rport=32957 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=ADD_GROUP msg=audit(1406106181.765:1236): user pid=26689 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=162 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406106181.832:1237): user pid=26689 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=162 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406106181.833:1238): user pid=26689 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=162 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_USER msg=audit(1406106181.892:1239): user pid=26694 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=162 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' >type=ADD_USER msg=audit(1406106181.892:1240): user pid=26694 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to group acct="nova" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' >type=ADD_USER msg=audit(1406106181.892:1241): user pid=26694 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to group acct="nova" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' >type=ADD_USER msg=audit(1406106181.892:1242): user pid=26694 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to shadow group acct="nova" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' >type=ADD_USER msg=audit(1406106181.892:1243): user pid=26694 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to shadow group acct="nova" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106190.739:1244): user pid=26703 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26703 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106190.739:1245): user pid=26703 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26703 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106190.741:1246): user pid=26702 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26703 suid=74 rport=32961 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106190.741:1247): user pid=26702 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26703 suid=74 rport=32961 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106190.798:1248): user pid=26702 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32961 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106190.798:1249): user pid=26702 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32961 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106190.803:1250): user pid=26702 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106190.803:1251): user pid=26702 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26703 suid=74 rport=32961 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106190.803:1252): user pid=26702 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106190.804:1253): user pid=26702 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106190.804:1254): pid=26702 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=60 >type=USER_ROLE_CHANGE msg=audit(1406106190.876:1255): user pid=26702 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106190.892:1256): user pid=26702 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106190.893:1257): user pid=26702 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106190.893:1258): user pid=26702 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106190.894:1259): user pid=26705 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26705 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106190.894:1260): user pid=26705 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26705 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106190.896:1261): user pid=26705 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106190.929:1262): user pid=26702 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106190.929:1263): user pid=26702 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106190.930:1264): user pid=26702 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106190.930:1265): user pid=26702 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106190.930:1266): user pid=26702 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26702 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106190.930:1267): user pid=26702 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26702 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106190.930:1268): user pid=26702 uid=0 auid=0 ses=60 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26702 suid=0 rport=32961 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=ADD_GROUP msg=audit(1406106198.975:1269): user pid=26715 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=498 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406106199.058:1270): user pid=26715 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=498 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=ADD_GROUP msg=audit(1406106199.059:1271): user pid=26715 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=498 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106200.402:1272): user pid=26721 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26721 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106200.402:1273): user pid=26721 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26721 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106200.402:1274): user pid=26720 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26721 suid=74 rport=32964 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106200.402:1275): user pid=26720 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26721 suid=74 rport=32964 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106200.469:1276): user pid=26720 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32964 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106200.469:1277): user pid=26720 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32964 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106200.476:1278): user pid=26720 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106200.477:1279): user pid=26720 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26721 suid=74 rport=32964 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106200.477:1280): user pid=26720 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106200.478:1281): user pid=26720 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106200.478:1282): pid=26720 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=61 >type=USER_ROLE_CHANGE msg=audit(1406106200.551:1283): user pid=26720 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106200.560:1284): user pid=26720 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106200.562:1285): user pid=26720 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106200.563:1286): user pid=26720 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106200.563:1287): user pid=26723 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26723 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106200.564:1288): user pid=26723 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26723 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106200.565:1289): user pid=26723 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106200.608:1290): user pid=26720 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106200.608:1291): user pid=26720 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106200.609:1292): user pid=26720 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106200.610:1293): user pid=26720 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106200.610:1294): user pid=26720 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26720 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106200.610:1295): user pid=26720 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26720 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106200.610:1296): user pid=26720 uid=0 auid=0 ses=61 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26720 suid=0 rport=32964 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_CHAUTHTOK msg=audit(1406106209.004:1297): user pid=26742 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to group acct="nova" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success' >type=USER_CHAUTHTOK msg=audit(1406106209.007:1298): user pid=26742 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user to shadow group acct="nova" exe="/usr/sbin/usermod" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106210.057:1299): user pid=26750 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26750 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106210.057:1300): user pid=26750 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26750 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106210.058:1301): user pid=26749 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26750 suid=74 rport=32967 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106210.058:1302): user pid=26749 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26750 suid=74 rport=32967 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106210.115:1303): user pid=26749 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32967 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106210.115:1304): user pid=26749 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32967 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106210.120:1305): user pid=26749 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106210.120:1306): user pid=26749 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26750 suid=74 rport=32967 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106210.121:1307): user pid=26749 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106210.121:1308): user pid=26749 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106210.121:1309): pid=26749 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=62 >type=USER_ROLE_CHANGE msg=audit(1406106210.197:1310): user pid=26749 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106210.209:1311): user pid=26749 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106210.211:1312): user pid=26749 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106210.212:1313): user pid=26749 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106210.212:1314): user pid=26752 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26752 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106210.212:1315): user pid=26752 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26752 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106210.213:1316): user pid=26752 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106210.247:1317): user pid=26749 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106210.248:1318): user pid=26749 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106210.248:1319): user pid=26749 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106210.249:1320): user pid=26749 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106210.249:1321): user pid=26749 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26749 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106210.249:1322): user pid=26749 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26749 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106210.249:1323): user pid=26749 uid=0 auid=0 ses=62 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26749 suid=0 rport=32967 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106213.465:1324): user pid=26761 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26761 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106213.466:1325): user pid=26761 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26761 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106213.466:1326): user pid=26760 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=26761 suid=74 rport=32971 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106213.466:1327): user pid=26760 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=26761 suid=74 rport=32971 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106213.525:1328): user pid=26760 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32971 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106213.525:1329): user pid=26760 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32971 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106213.530:1330): user pid=26760 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106213.531:1331): user pid=26760 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26761 suid=74 rport=32971 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106213.531:1332): user pid=26760 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106213.532:1333): user pid=26760 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106213.532:1334): pid=26760 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=63 >type=USER_ROLE_CHANGE msg=audit(1406106213.602:1335): user pid=26760 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106213.617:1336): user pid=26760 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106213.620:1337): user pid=26760 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106213.621:1338): user pid=26760 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106213.622:1339): user pid=26763 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26763 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106213.622:1340): user pid=26763 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26763 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106213.623:1341): user pid=26763 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106213.664:1342): user pid=26760 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106213.664:1343): user pid=26760 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106213.665:1344): user pid=26760 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106213.666:1345): user pid=26760 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106213.666:1346): user pid=26760 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=26760 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106213.666:1347): user pid=26760 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=26760 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106213.666:1348): user pid=26760 uid=0 auid=0 ses=63 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=26760 suid=0 rport=32971 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=ANOM_PROMISCUOUS msg=audit(1406106214.745:1349): dev=virbr0-nic prom=256 old_prom=0 auid=0 uid=0 gid=0 ses=46 >type=SYSCALL msg=audit(1406106214.745:1349): arch=c000003e syscall=16 success=yes exit=0 a0=11 a1=89a2 a2=7fa61c9b0ae0 a3=7fa61c9b0840 items=0 ppid=1 pid=26824 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.761:1350): table=filter family=2 entries=7 >type=SYSCALL msg=audit(1406106214.761:1350): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1aae7a0 items=0 ppid=26813 pid=26864 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.764:1351): table=filter family=2 entries=8 >type=SYSCALL msg=audit(1406106214.764:1351): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=c5b920 items=0 ppid=26813 pid=26875 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.776:1352): table=mangle family=2 entries=0 >type=SYSCALL msg=audit(1406106214.776:1352): arch=c000003e syscall=175 success=yes exit=0 a0=164c220 a1=22d0 a2=16444e0 a3=7ffff43e4f10 items=0 ppid=26881 pid=26882 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/sbin/modprobe" subj=system_u:system_r:insmod_t:s0 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.780:1353): table=mangle family=2 entries=6 >type=SYSCALL msg=audit(1406106214.780:1353): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1b74290 items=0 ppid=26813 pid=26880 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.797:1354): table=filter family=2 entries=9 >type=SYSCALL msg=audit(1406106214.797:1354): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=a59b50 items=0 ppid=26813 pid=26920 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.799:1355): table=filter family=2 entries=10 >type=SYSCALL msg=audit(1406106214.799:1355): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2250cd0 items=0 ppid=26813 pid=26921 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.801:1356): table=filter family=2 entries=11 >type=SYSCALL msg=audit(1406106214.801:1356): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1a8d620 items=0 ppid=26813 pid=26922 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.853:1357): table=filter family=2 entries=12 >type=SYSCALL msg=audit(1406106214.853:1357): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=18347a0 items=0 ppid=26813 pid=26940 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.855:1358): table=filter family=2 entries=13 >type=SYSCALL msg=audit(1406106214.855:1358): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=187e4d0 items=0 ppid=26813 pid=26941 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.856:1359): table=filter family=2 entries=14 >type=SYSCALL msg=audit(1406106214.856:1359): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1e2d650 items=0 ppid=26813 pid=26943 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.858:1360): table=filter family=2 entries=15 >type=SYSCALL msg=audit(1406106214.858:1360): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1055250 items=0 ppid=26813 pid=26944 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.917:1361): table=nat family=2 entries=0 >type=SYSCALL msg=audit(1406106214.917:1361): arch=c000003e syscall=175 success=yes exit=0 a0=262ccf0 a1=3ef0 a2=261c4e0 a3=7fffb1438370 items=0 ppid=26963 pid=26964 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/sbin/modprobe" subj=system_u:system_r:insmod_t:s0 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.921:1362): table=nat family=2 entries=4 >type=SYSCALL msg=audit(1406106214.921:1362): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1782620 items=0 ppid=26813 pid=26962 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.928:1363): table=nat family=2 entries=5 >type=SYSCALL msg=audit(1406106214.928:1363): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=207b800 items=0 ppid=26813 pid=26971 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106214.931:1364): table=nat family=2 entries=6 >type=SYSCALL msg=audit(1406106214.931:1364): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=cb1700 items=0 ppid=26813 pid=26972 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106215.081:1365): table=filter family=10 entries=0 >type=SYSCALL msg=audit(1406106215.081:1365): arch=c000003e syscall=175 success=yes exit=0 a0=1251220 a1=22c8 a2=12494e0 a3=7fff338d39f0 items=0 ppid=27014 pid=27015 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="modprobe" exe="/sbin/modprobe" subj=system_u:system_r:insmod_t:s0 key=(null) >type=NETFILTER_CFG msg=audit(1406106215.370:1366): table=filter family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106215.370:1366): table=mangle family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106215.370:1366): table=nat family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106215.370:1366): table=filter family=10 entries=0 >type=SYSCALL msg=audit(1406106215.370:1366): arch=c000003e syscall=56 success=yes exit=27134 a0=6c020011 a1=7fa6140aec10 a2=8 a3=30000a7373 items=0 ppid=1 pid=26824 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=SYSCALL msg=audit(1406106215.370:1367): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7fa6140aec10 a2=8 a3=30000a7373 items=0 ppid=26824 pid=27134 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=FD_PAIR msg=audit(1406106215.370:1367): fd0=0 fd1=0 >type=USER_START msg=audit(1406106215.921:1368): user pid=27298 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' >type=CRED_ACQ msg=audit(1406106215.922:1369): user pid=27298 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406106215.923:1370): user pid=27298 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406106215.923:1371): user pid=27298 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106219.893:1372): user pid=27415 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27415 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106219.894:1373): user pid=27415 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27415 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106219.895:1374): user pid=27414 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=27415 suid=74 rport=32973 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106219.895:1375): user pid=27414 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=27415 suid=74 rport=32973 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106219.959:1376): user pid=27414 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=32973 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106219.959:1377): user pid=27414 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=32973 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106219.964:1378): user pid=27414 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106219.964:1379): user pid=27414 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27415 suid=74 rport=32973 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106219.964:1380): user pid=27414 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106219.965:1381): user pid=27414 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106219.965:1382): pid=27414 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=64 >type=USER_ROLE_CHANGE msg=audit(1406106220.039:1383): user pid=27414 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106220.049:1384): user pid=27414 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106220.051:1385): user pid=27414 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106220.052:1386): user pid=27414 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106220.053:1387): user pid=27417 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27417 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106220.053:1388): user pid=27417 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27417 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106220.054:1389): user pid=27417 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106220.091:1390): user pid=27414 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106220.093:1391): user pid=27414 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106220.093:1392): user pid=27414 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106220.094:1393): user pid=27414 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106220.094:1394): user pid=27414 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27414 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106220.094:1395): user pid=27414 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27414 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106220.094:1396): user pid=27414 uid=0 auid=0 ses=64 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27414 suid=0 rport=32973 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106375.531:1397): user pid=27425 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27425 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106375.531:1398): user pid=27425 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27425 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106375.532:1399): user pid=27424 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=27425 suid=74 rport=33230 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106375.532:1400): user pid=27424 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=27425 suid=74 rport=33230 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106375.595:1401): user pid=27424 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=33230 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106375.595:1402): user pid=27424 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=33230 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106375.600:1403): user pid=27424 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106375.600:1404): user pid=27424 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27425 suid=74 rport=33230 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106375.601:1405): user pid=27424 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106375.601:1406): user pid=27424 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106375.602:1407): pid=27424 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=65 >type=USER_ROLE_CHANGE msg=audit(1406106375.666:1408): user pid=27424 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106375.678:1409): user pid=27424 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106375.680:1410): user pid=27424 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106375.680:1411): user pid=27424 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106375.681:1412): user pid=27427 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27427 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106375.681:1413): user pid=27427 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27427 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106375.682:1414): user pid=27427 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106375.712:1415): user pid=27424 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106375.713:1416): user pid=27424 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106375.714:1417): user pid=27424 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106375.715:1418): user pid=27424 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106375.715:1419): user pid=27424 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27424 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106375.715:1420): user pid=27424 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27424 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106375.715:1421): user pid=27424 uid=0 auid=0 ses=65 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27424 suid=0 rport=33230 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106376.154:1422): user pid=27479 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27479 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106376.154:1423): user pid=27479 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27479 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106376.154:1424): user pid=27477 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=27479 suid=74 rport=33233 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106376.154:1425): user pid=27477 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=27479 suid=74 rport=33233 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106376.207:1426): user pid=27477 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=33233 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106376.207:1427): user pid=27477 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=33233 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106376.213:1428): user pid=27477 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106376.213:1429): user pid=27477 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27479 suid=74 rport=33233 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106376.214:1430): user pid=27477 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106376.214:1431): user pid=27477 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106376.214:1432): pid=27477 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=66 >type=USER_ROLE_CHANGE msg=audit(1406106376.288:1433): user pid=27477 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106376.303:1434): user pid=27477 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106376.304:1435): user pid=27477 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106376.304:1436): user pid=27477 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106376.305:1437): user pid=27576 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27576 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106376.305:1438): user pid=27576 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27576 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106376.307:1439): user pid=27576 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106376.326:1440): user pid=27477 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106376.327:1441): user pid=27477 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106376.327:1442): user pid=27477 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106376.328:1443): user pid=27477 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106376.328:1444): user pid=27477 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27477 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106376.328:1445): user pid=27477 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27477 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106376.328:1446): user pid=27477 uid=0 auid=0 ses=66 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27477 suid=0 rport=33233 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406106376.590:1447): table=filter family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106376.590:1447): table=mangle family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106376.590:1447): table=nat family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106376.590:1447): table=filter family=10 entries=0 >type=SYSCALL msg=audit(1406106376.590:1447): arch=c000003e syscall=272 success=yes exit=0 a0=40000000 a1=c0 a2=0 a3=7fff0e8a7f60 items=0 ppid=27718 pid=27725 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=65 comm="ip" exe="/sbin/ip" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106376.630:1448): table=filter family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106376.630:1448): table=mangle family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106376.630:1448): table=nat family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106376.630:1448): table=filter family=10 entries=0 >type=SYSCALL msg=audit(1406106376.630:1448): arch=c000003e syscall=272 success=yes exit=0 a0=40000000 a1=c0 a2=0 a3=7fff9e9cc8b0 items=0 ppid=27718 pid=27729 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=65 comm="ip" exe="/sbin/ip" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406106377.002:1449): table=filter family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106377.002:1449): table=mangle family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106377.002:1449): table=nat family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406106377.002:1449): table=filter family=10 entries=0 >type=SYSCALL msg=audit(1406106377.002:1449): arch=c000003e syscall=272 success=yes exit=0 a0=40000000 a1=c0 a2=0 a3=7fff3a0282b0 items=0 ppid=27718 pid=27731 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=65 comm="ip" exe="/sbin/ip" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) >type=CRYPTO_KEY_USER msg=audit(1406106382.801:1450): user pid=27785 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27785 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106382.801:1451): user pid=27785 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27785 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106382.802:1452): user pid=27784 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=27785 suid=74 rport=33248 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106382.802:1453): user pid=27784 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=27785 suid=74 rport=33248 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106382.860:1454): user pid=27784 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=33248 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106382.860:1455): user pid=27784 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=33248 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106382.864:1456): user pid=27784 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106382.865:1457): user pid=27784 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27785 suid=74 rport=33248 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106382.865:1458): user pid=27784 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106382.866:1459): user pid=27784 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106382.866:1460): pid=27784 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=67 >type=USER_ROLE_CHANGE msg=audit(1406106382.936:1461): user pid=27784 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106382.950:1462): user pid=27784 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106382.951:1463): user pid=27784 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106382.952:1464): user pid=27784 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106382.952:1465): user pid=27787 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27787 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106382.952:1466): user pid=27787 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27787 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106382.954:1467): user pid=27787 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106382.984:1468): user pid=27784 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106382.985:1469): user pid=27784 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106382.986:1470): user pid=27784 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106382.986:1471): user pid=27784 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106382.986:1472): user pid=27784 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27784 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106382.986:1473): user pid=27784 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27784 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106382.986:1474): user pid=27784 uid=0 auid=0 ses=67 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27784 suid=0 rport=33248 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106383.241:1475): user pid=27795 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27795 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106383.241:1476): user pid=27795 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27795 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106383.241:1477): user pid=27794 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=27795 suid=74 rport=33250 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106383.241:1478): user pid=27794 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=27795 suid=74 rport=33250 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106383.303:1479): user pid=27794 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=33250 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106383.303:1480): user pid=27794 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=33250 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106383.308:1481): user pid=27794 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106383.308:1482): user pid=27794 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27795 suid=74 rport=33250 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106383.309:1483): user pid=27794 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106383.315:1484): user pid=27794 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106383.316:1485): pid=27794 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=68 >type=USER_ROLE_CHANGE msg=audit(1406106383.381:1486): user pid=27794 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106383.398:1487): user pid=27794 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106383.400:1488): user pid=27794 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106383.400:1489): user pid=27794 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106383.401:1490): user pid=27797 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27797 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106383.401:1491): user pid=27797 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27797 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106383.402:1492): user pid=27797 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106383.532:1493): user pid=27794 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106383.533:1494): user pid=27794 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106383.534:1495): user pid=27794 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106383.534:1496): user pid=27794 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106383.534:1497): user pid=27794 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27794 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106383.534:1498): user pid=27794 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27794 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106383.534:1499): user pid=27794 uid=0 auid=0 ses=68 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27794 suid=0 rport=33250 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106384.679:1500): user pid=27816 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27816 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106384.679:1501): user pid=27816 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27816 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106384.680:1502): user pid=27815 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=27816 suid=74 rport=33255 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406106384.680:1503): user pid=27815 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=27816 suid=74 rport=33255 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106384.737:1504): user pid=27815 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=33255 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106384.737:1505): user pid=27815 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=ca:97:4e:fd:1c:01:88:c6:83:8a:df:4b:ba:33:68:12 rport=33255 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106384.741:1506): user pid=27815 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106384.742:1507): user pid=27815 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27816 suid=74 rport=33255 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_AUTH msg=audit(1406106384.742:1508): user pid=27815 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406106384.742:1509): user pid=27815 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=LOGIN msg=audit(1406106384.743:1510): pid=27815 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=69 >type=USER_ROLE_CHANGE msg=audit(1406106384.805:1511): user pid=27815 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106384.816:1512): user pid=27815 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406106384.819:1513): user pid=27815 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_START msg=audit(1406106384.820:1514): user pid=27815 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106384.820:1515): user pid=27818 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27818 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106384.820:1516): user pid=27818 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27818 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRED_REFR msg=audit(1406106384.821:1517): user pid=27818 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106384.882:1518): user pid=27815 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406106384.883:1519): user pid=27815 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_END msg=audit(1406106384.883:1520): user pid=27815 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406106384.884:1521): user pid=27815 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=cloud-qe-19.idm.lab.bos.redhat.com addr=10.16.96.136 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406106384.884:1522): user pid=27815 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=27815 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106384.884:1523): user pid=27815 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=27815 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406106384.884:1524): user pid=27815 uid=0 auid=0 ses=69 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=27815 suid=0 rport=33255 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.136 terminal=? res=success' >type=USER_ACCT msg=audit(1406106601.306:1525): user pid=27826 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406106601.306:1526): user pid=27826 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406106601.310:1527): pid=27826 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=70 >type=USER_START msg=audit(1406106601.316:1528): user pid=27826 uid=0 auid=0 ses=70 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406106601.395:1529): user pid=27826 uid=0 auid=0 ses=70 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406106601.395:1530): user pid=27826 uid=0 auid=0 ses=70 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406107201.399:1531): user pid=27829 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406107201.399:1532): user pid=27829 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406107201.400:1533): pid=27829 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=71 >type=USER_START msg=audit(1406107201.405:1534): user pid=27829 uid=0 auid=0 ses=71 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406107201.463:1535): user pid=27829 uid=0 auid=0 ses=71 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406107201.463:1536): user pid=27829 uid=0 auid=0 ses=71 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_START msg=audit(1406107453.455:1537): user pid=27859 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success' >type=CRED_ACQ msg=audit(1406107453.455:1538): user pid=27859 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success' >type=CRED_DISP msg=audit(1406107453.458:1539): user pid=27859 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success' >type=USER_END msg=audit(1406107453.458:1540): user pid=27859 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="nova" exe="/sbin/runuser" hostname=? addr=? terminal=pts/0 res=success' >type=USER_CMD msg=audit(1406107535.968:1541): user pid=27946 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C206164646272206272313030 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107535.968:1542): user pid=27946 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107535.971:1543): user pid=27946 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.014:1544): user pid=27946 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.014:1545): user pid=27946 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.027:1546): user pid=27953 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2073657466642062723130302030 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.027:1547): user pid=27953 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.027:1548): user pid=27953 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.056:1549): user pid=27953 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.057:1550): user pid=27953 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.068:1551): user pid=27974 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C20737470206272313030206F6666 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.068:1552): user pid=27974 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.068:1553): user pid=27974 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.096:1554): user pid=27974 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.097:1555): user pid=27974 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.108:1556): user pid=27977 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B20736574206272313030207570 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.108:1557): user pid=27977 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.108:1558): user pid=27977 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.151:1559): user pid=27977 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.151:1560): user pid=27977 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.162:1561): user pid=27980 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.162:1562): user pid=27980 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.162:1563): user pid=27980 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=ANOM_PROMISCUOUS msg=audit(1406107536.188:1564): dev=eth0 prom=256 old_prom=0 auid=0 uid=0 gid=0 ses=1 >type=SYSCALL msg=audit(1406107536.188:1564): arch=c000003e syscall=16 success=yes exit=0 a0=3 a1=89a2 a2=7fffc956b7a0 a3=7fffc956b4f0 items=0 ppid=27981 pid=27982 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="brctl" exe="/usr/sbin/brctl" subj=unconfined_u:system_r:brctl_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406107536.200:1565): user pid=27980 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.200:1566): user pid=27980 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.211:1567): user pid=27983 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.211:1568): user pid=27983 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.211:1569): user pid=27983 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.241:1570): user pid=27983 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.241:1571): user pid=27983 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.259:1572): user pid=27987 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620697020726F7574652064656C2064656661756C74207669612031302E31362E39392E323534 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.259:1573): user pid=27987 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.259:1574): user pid=27987 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.288:1575): user pid=27987 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.288:1576): user pid=27987 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.307:1577): user pid=27991 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620697020616464722064656C2031302E31362E39362E3130322F3232206272642031302E31362E39392E3235352073636F706520676C6F62616C206465762065746830 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.307:1578): user pid=27991 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.307:1579): user pid=27991 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.337:1580): user pid=27991 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.337:1581): user pid=27991 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.348:1582): user pid=27994 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069702061646472206164642031302E31362E39362E3130322F3232206272642031302E31362E39392E3235352073636F706520676C6F62616C20646576206272313030 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.349:1583): user pid=27994 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.349:1584): user pid=27994 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.378:1585): user pid=27994 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.378:1586): user pid=27994 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.389:1587): user pid=27997 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620697020726F757465206164642064656661756C74207669612031302E31362E39392E323534 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.389:1588): user pid=27997 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.389:1589): user pid=27997 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.418:1590): user pid=27997 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.418:1591): user pid=27997 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.657:1592): user pid=28000 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.657:1593): user pid=28000 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.657:1594): user pid=28000 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.701:1595): user pid=28000 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.701:1596): user pid=28000 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.712:1597): user pid=28004 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.712:1598): user pid=28004 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.712:1599): user pid=28004 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406107536.738:1600): table=nat family=2 entries=7 >type=SYSCALL msg=audit(1406107536.738:1600): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=14d5890 items=0 ppid=28005 pid=28006 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406107536.738:1601): table=mangle family=2 entries=7 >type=SYSCALL msg=audit(1406107536.738:1601): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=14d5a90 items=0 ppid=28005 pid=28006 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406107536.741:1602): table=filter family=2 entries=16 >type=SYSCALL msg=audit(1406107536.741:1602): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=14d9bb0 items=0 ppid=28005 pid=28006 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406107536.744:1603): user pid=28004 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.744:1604): user pid=28004 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.808:1605): user pid=28008 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.808:1606): user pid=28008 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.808:1607): user pid=28008 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.839:1608): user pid=28008 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.839:1609): user pid=28008 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.849:1610): user pid=28012 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.850:1611): user pid=28012 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.850:1612): user pid=28012 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406107536.876:1613): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406107536.876:1613): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=b654a0 items=0 ppid=28013 pid=28014 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406107536.876:1614): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406107536.876:1614): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=b64c40 items=0 ppid=28013 pid=28014 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406107536.877:1615): table=filter family=2 entries=39 >type=SYSCALL msg=audit(1406107536.877:1615): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=b69d20 items=0 ppid=28013 pid=28014 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406107536.880:1616): user pid=28012 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.881:1617): user pid=28012 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.891:1618): user pid=28016 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.892:1619): user pid=28016 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.892:1620): user pid=28016 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107536.922:1621): user pid=28016 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.922:1622): user pid=28016 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107536.933:1623): user pid=28020 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107536.933:1624): user pid=28020 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107536.934:1625): user pid=28020 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406107536.960:1626): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406107536.960:1626): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=fdb4a0 items=0 ppid=28021 pid=28022 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406107536.960:1627): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406107536.960:1627): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=fdac40 items=0 ppid=28021 pid=28022 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406107536.961:1628): table=filter family=2 entries=48 >type=SYSCALL msg=audit(1406107536.961:1628): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=fe0530 items=0 ppid=28021 pid=28022 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406107536.965:1629): user pid=28020 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107536.965:1630): user pid=28020 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=VIRT_MACHINE_ID msg=audit(1406107537.000:1631): user pid=26813 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 vm-ctx=unconfined_u:system_r:svirt_t:s0:c115,c768 img-ctx=unconfined_u:object_r:svirt_image_t:s0:c115,c768 model=selinux exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_MACHINE_ID msg=audit(1406107537.000:1632): user pid=26813 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 vm-ctx=107:107 img-ctx=107:107 model=dac exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=ANOM_PROMISCUOUS msg=audit(1406107537.013:1633): dev=vnet0 prom=256 old_prom=0 auid=0 uid=0 gid=0 ses=46 >type=SYSCALL msg=audit(1406107537.013:1633): arch=c000003e syscall=16 success=yes exit=0 a0=19 a1=89a2 a2=7fa6223b8b90 a3=3a2032373a65736f items=0 ppid=1 pid=26815 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=46 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=VIRT_RESOURCE msg=audit(1406107537.023:1634): user pid=26813 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=net reason=open vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 net=FA:16:3E:36:8F:1B path="/dev/net/tun" rdev=0A:C8 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_RESOURCE msg=audit(1406107537.186:1635): user pid=26813 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=net reason=open vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 net=FA:16:3E:36:8F:1B path="/dev/vhost-net" rdev=0A:39 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_RESOURCE msg=audit(1406107537.465:1636): user pid=26813 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-disk="?" new-disk="/var/lib/nova/instances/8c02e375-acb8-4231-80fa-bf36e529c560/disk" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_RESOURCE msg=audit(1406107537.465:1637): user pid=26813 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=net reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-net=? new-net=FA:16:3E:36:8F:1B exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_RESOURCE msg=audit(1406107537.465:1638): user pid=26813 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=mem reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-mem=0 new-mem=2097152 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_RESOURCE msg=audit(1406107537.465:1639): user pid=26813 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=vcpu reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-vcpu=0 new-vcpu=1 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_CONTROL msg=audit(1406107537.465:1640): user pid=26813 uid=0 auid=0 ses=46 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm op=start reason=booted vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 vm-pid=28247 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406107537.482:1641): user pid=28255 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620746565202F7379732F636C6173732F6E65742F766E6574302F6272706F72742F6861697270696E5F6D6F6465 terminal=? res=success' >type=CRED_ACQ msg=audit(1406107537.482:1642): user pid=28255 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406107537.483:1643): user pid=28255 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406107537.512:1644): user pid=28255 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406107537.512:1645): user pid=28255 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=MAC_STATUS msg=audit(1406107767.962:1646): enforcing=0 old_enforcing=1 auid=0 ses=1 >type=SYSCALL msg=audit(1406107767.962:1646): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fffb27e42c0 a2=1 a3=7fffb27e3040 items=0 ppid=6600 pid=28292 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) >type=USER_ACCT msg=audit(1406107801.483:1647): user pid=28303 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406107801.483:1648): user pid=28303 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406107801.487:1649): pid=28303 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=72 >type=USER_START msg=audit(1406107801.493:1650): user pid=28303 uid=0 auid=0 ses=72 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406107801.566:1651): user pid=28303 uid=0 auid=0 ses=72 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406107801.566:1652): user pid=28303 uid=0 auid=0 ses=72 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=NETFILTER_CFG msg=audit(1406108000.266:1653): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108000.266:1653): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2751aa0 items=0 ppid=28349 pid=28364 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.268:1654): table=nat family=2 entries=24 >type=SYSCALL msg=audit(1406108000.268:1654): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1080910 items=0 ppid=28349 pid=28365 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.269:1655): table=nat family=2 entries=23 >type=SYSCALL msg=audit(1406108000.269:1655): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=15475b0 items=0 ppid=28349 pid=28366 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.271:1656): table=filter family=2 entries=50 >type=SYSCALL msg=audit(1406108000.271:1656): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=217dd30 items=0 ppid=28349 pid=28367 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.272:1657): table=filter family=2 entries=49 >type=SYSCALL msg=audit(1406108000.272:1657): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1660100 items=0 ppid=28349 pid=28368 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.273:1658): table=filter family=2 entries=48 >type=SYSCALL msg=audit(1406108000.273:1658): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1808f90 items=0 ppid=28349 pid=28369 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.275:1659): table=filter family=2 entries=47 >type=SYSCALL msg=audit(1406108000.275:1659): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=9e1250 items=0 ppid=28349 pid=28370 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.276:1660): table=filter family=2 entries=46 >type=SYSCALL msg=audit(1406108000.276:1660): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=20950e0 items=0 ppid=28349 pid=28371 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.277:1661): table=filter family=2 entries=45 >type=SYSCALL msg=audit(1406108000.277:1661): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=17d77b0 items=0 ppid=28349 pid=28372 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.279:1662): table=filter family=2 entries=44 >type=SYSCALL msg=audit(1406108000.279:1662): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1e0d640 items=0 ppid=28349 pid=28373 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.280:1663): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108000.280:1663): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1510120 items=0 ppid=28349 pid=28374 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.281:1664): table=filter family=2 entries=43 >type=SYSCALL msg=audit(1406108000.281:1664): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=d11400 items=0 ppid=28349 pid=28375 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.283:1665): table=filter family=2 entries=42 >type=SYSCALL msg=audit(1406108000.283:1665): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=ed4290 items=0 ppid=28349 pid=28376 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.284:1666): table=filter family=2 entries=41 >type=SYSCALL msg=audit(1406108000.284:1666): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=22c6290 items=0 ppid=28349 pid=28377 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.285:1667): table=filter family=2 entries=42 >type=SYSCALL msg=audit(1406108000.285:1667): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=109f410 items=0 ppid=28349 pid=28378 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.287:1668): table=mangle family=2 entries=9 >type=SYSCALL msg=audit(1406108000.287:1668): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1394060 items=0 ppid=28349 pid=28379 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.288:1669): table=filter family=2 entries=43 >type=SYSCALL msg=audit(1406108000.288:1669): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1517640 items=0 ppid=28349 pid=28380 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.290:1670): table=filter family=2 entries=44 >type=SYSCALL msg=audit(1406108000.290:1670): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=12597c0 items=0 ppid=28349 pid=28381 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.291:1671): table=filter family=2 entries=45 >type=SYSCALL msg=audit(1406108000.291:1671): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=27a50e0 items=0 ppid=28349 pid=28382 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.292:1672): table=filter family=2 entries=46 >type=SYSCALL msg=audit(1406108000.292:1672): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=16ae260 items=0 ppid=28349 pid=28383 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.293:1673): table=filter family=2 entries=47 >type=SYSCALL msg=audit(1406108000.293:1673): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=170bf90 items=0 ppid=28349 pid=28384 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.295:1674): table=filter family=2 entries=48 >type=SYSCALL msg=audit(1406108000.295:1674): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1ae4110 items=0 ppid=28349 pid=28385 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.296:1675): table=filter family=2 entries=49 >type=SYSCALL msg=audit(1406108000.296:1675): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1995d40 items=0 ppid=28349 pid=28386 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.297:1676): table=nat family=2 entries=22 >type=SYSCALL msg=audit(1406108000.297:1676): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1c365c0 items=0 ppid=28349 pid=28387 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.298:1677): table=nat family=2 entries=23 >type=SYSCALL msg=audit(1406108000.298:1677): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=174d910 items=0 ppid=28349 pid=28388 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.300:1678): table=nat family=2 entries=24 >type=SYSCALL msg=audit(1406108000.300:1678): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=19c5ab0 items=0 ppid=28349 pid=28389 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108000.536:1679): table=filter family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108000.536:1679): table=mangle family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108000.536:1679): table=nat family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108000.536:1679): table=filter family=10 entries=0 >type=SYSCALL msg=audit(1406108000.536:1679): arch=c000003e syscall=56 success=yes exit=28456 a0=6c020011 a1=7f122c166d70 a2=8 a3=a7373 items=0 ppid=1 pid=28360 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=SYSCALL msg=audit(1406108000.536:1680): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7f122c166d70 a2=8 a3=a7373 items=0 ppid=28360 pid=28456 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=FD_PAIR msg=audit(1406108000.536:1680): fd0=0 fd1=0 >type=USER_END msg=audit(1406108147.532:1681): user pid=6597 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406108147.532:1682): user pid=6597 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_END msg=audit(1406108147.533:1683): user pid=6597 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success' >type=USER_LOGOUT msg=audit(1406108147.533:1684): user pid=6597 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success' >type=CRYPTO_KEY_USER msg=audit(1406108147.533:1685): user pid=6597 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=6597 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108147.533:1686): user pid=6597 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=6597 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108147.533:1687): user pid=6597 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=6597 suid=0 rport=51465 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108162.277:1688): user pid=28697 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=28697 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108162.277:1689): user pid=28697 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=28697 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108162.545:1690): user pid=28696 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=28697 suid=74 rport=52175 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108162.545:1691): user pid=28696 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=28697 suid=74 rport=52175 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406108178.405:1692): user pid=28696 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52175 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406108178.405:1693): user pid=28696 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=30:fc:fa:a3:71:ac:1b:8b:03:8b:4e:4b:5f:37:dc:af rport=52175 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_ACCT msg=audit(1406108178.410:1694): user pid=28696 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406108178.410:1695): user pid=28696 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=28697 suid=74 rport=52175 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406108178.410:1696): user pid=28696 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406108178.411:1697): user pid=28696 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=LOGIN msg=audit(1406108178.411:1698): pid=28696 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=73 >type=USER_ROLE_CHANGE msg=audit(1406108178.484:1699): user pid=28696 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_START msg=audit(1406108178.495:1700): user pid=28696 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406108178.937:1701): user pid=28703 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=/dev/pts/0 res=success' >type=USER_START msg=audit(1406108178.937:1702): user pid=28703 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=/dev/pts/0 res=success' >type=CRYPTO_KEY_USER msg=audit(1406108178.937:1703): user pid=28703 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=28703 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=pts/0 res=success' >type=CRYPTO_KEY_USER msg=audit(1406108178.937:1704): user pid=28703 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=28703 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=pts/0 res=success' >type=CRED_REFR msg=audit(1406108178.939:1705): user pid=28703 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_ACCT msg=audit(1406108401.586:1706): user pid=28757 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406108401.586:1707): user pid=28757 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406108401.592:1708): pid=28757 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=74 >type=USER_START msg=audit(1406108401.600:1709): user pid=28757 uid=0 auid=0 ses=74 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406108401.687:1710): user pid=28757 uid=0 auid=0 ses=74 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406108401.687:1711): user pid=28757 uid=0 auid=0 ses=74 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=ANOM_PROMISCUOUS msg=audit(1406108412.508:1712): dev=vnet0 prom=0 old_prom=256 auid=0 uid=107 gid=107 ses=46 >type=SYSCALL msg=audit(1406108412.508:1712): arch=c000003e syscall=3 success=yes exit=0 a0=18 a1=7fff1557e5c0 a2=8 a3=0 items=0 ppid=1 pid=28247 auid=0 uid=107 gid=107 euid=107 suid=107 fsuid=107 egid=107 sgid=107 fsgid=107 tty=(none) ses=46 comm="qemu-kvm" exe="/usr/libexec/qemu-kvm" subj=unconfined_u:system_r:svirt_t:s0:c115,c768 key=(null) >type=VIRT_CONTROL msg=audit(1406108412.887:1713): user pid=28349 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm op=stop reason=migrated vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 vm-pid=-1 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108412.940:1714): user pid=28846 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620636174202F6574632F69736373692F696E69746961746F726E616D652E6973637369 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108412.940:1715): user pid=28846 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108412.940:1716): user pid=28846 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108412.970:1717): user pid=28846 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108412.970:1718): user pid=28846 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108412.980:1719): user pid=28849 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620737973746F6F6C202D632066635F686F7374202D76 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108412.980:1720): user pid=28849 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108412.980:1721): user pid=28849 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108413.009:1722): user pid=28849 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108413.009:1723): user pid=28849 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108413.019:1724): user pid=28852 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620737973746F6F6C202D632066635F686F7374202D76 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108413.020:1725): user pid=28852 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108413.020:1726): user pid=28852 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108413.048:1727): user pid=28852 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108413.049:1728): user pid=28852 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108413.331:1729): user pid=28855 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108413.331:1730): user pid=28855 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108413.332:1731): user pid=28855 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108413.372:1732): user pid=28855 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108413.372:1733): user pid=28855 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108413.382:1734): user pid=28859 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108413.383:1735): user pid=28859 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108413.383:1736): user pid=28859 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108413.409:1737): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108413.409:1737): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=185a3c0 items=0 ppid=28860 pid=28861 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108413.409:1738): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108413.409:1738): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=185a100 items=0 ppid=28860 pid=28861 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108413.411:1739): table=filter family=2 entries=50 >type=SYSCALL msg=audit(1406108413.411:1739): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=185f390 items=0 ppid=28860 pid=28861 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406108413.414:1740): user pid=28859 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108413.414:1741): user pid=28859 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108629.164:1742): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108629.164:1742): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=9ddaa0 items=0 ppid=28888 pid=28903 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.165:1743): table=nat family=2 entries=24 >type=SYSCALL msg=audit(1406108629.165:1743): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2802910 items=0 ppid=28888 pid=28904 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.166:1744): table=nat family=2 entries=23 >type=SYSCALL msg=audit(1406108629.166:1744): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1e1c5b0 items=0 ppid=28888 pid=28905 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.167:1745): table=filter family=2 entries=41 >type=SYSCALL msg=audit(1406108629.167:1745): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1f4a000 items=0 ppid=28888 pid=28906 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.169:1746): table=filter family=2 entries=40 >type=SYSCALL msg=audit(1406108629.169:1746): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=aff3d0 items=0 ppid=28888 pid=28907 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.170:1747): table=filter family=2 entries=39 >type=SYSCALL msg=audit(1406108629.170:1747): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=953260 items=0 ppid=28888 pid=28908 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.171:1748): table=filter family=2 entries=38 >type=SYSCALL msg=audit(1406108629.171:1748): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2218520 items=0 ppid=28888 pid=28909 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.172:1749): table=filter family=2 entries=37 >type=SYSCALL msg=audit(1406108629.172:1749): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=17e03b0 items=0 ppid=28888 pid=28910 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.174:1750): table=filter family=2 entries=36 >type=SYSCALL msg=audit(1406108629.174:1750): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1138a80 items=0 ppid=28888 pid=28911 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.175:1751): table=filter family=2 entries=35 >type=SYSCALL msg=audit(1406108629.175:1751): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1959910 items=0 ppid=28888 pid=28912 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.177:1752): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108629.177:1752): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1985120 items=0 ppid=28888 pid=28913 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.178:1753): table=filter family=2 entries=34 >type=SYSCALL msg=audit(1406108629.178:1753): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=24e16d0 items=0 ppid=28888 pid=28914 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.179:1754): table=filter family=2 entries=33 >type=SYSCALL msg=audit(1406108629.179:1754): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=218f560 items=0 ppid=28888 pid=28915 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.181:1755): table=filter family=2 entries=32 >type=SYSCALL msg=audit(1406108629.181:1755): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1186560 items=0 ppid=28888 pid=28916 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.182:1756): table=filter family=2 entries=33 >type=SYSCALL msg=audit(1406108629.182:1756): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=b456e0 items=0 ppid=28888 pid=28917 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.183:1757): table=mangle family=2 entries=9 >type=SYSCALL msg=audit(1406108629.183:1757): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1cf4060 items=0 ppid=28888 pid=28918 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.185:1758): table=filter family=2 entries=34 >type=SYSCALL msg=audit(1406108629.185:1758): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=22c4910 items=0 ppid=28888 pid=28919 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.186:1759): table=filter family=2 entries=35 >type=SYSCALL msg=audit(1406108629.186:1759): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2201a90 items=0 ppid=28888 pid=28920 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.187:1760): table=filter family=2 entries=36 >type=SYSCALL msg=audit(1406108629.187:1760): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1ab93b0 items=0 ppid=28888 pid=28921 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.189:1761): table=filter family=2 entries=37 >type=SYSCALL msg=audit(1406108629.189:1761): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1373530 items=0 ppid=28888 pid=28922 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.190:1762): table=filter family=2 entries=38 >type=SYSCALL msg=audit(1406108629.190:1762): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1a86260 items=0 ppid=28888 pid=28923 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.191:1763): table=filter family=2 entries=39 >type=SYSCALL msg=audit(1406108629.191:1763): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=c7f3e0 items=0 ppid=28888 pid=28924 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.192:1764): table=filter family=2 entries=40 >type=SYSCALL msg=audit(1406108629.192:1764): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=14f1010 items=0 ppid=28888 pid=28925 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.193:1765): table=nat family=2 entries=22 >type=SYSCALL msg=audit(1406108629.193:1765): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1c9e5c0 items=0 ppid=28888 pid=28926 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.195:1766): table=nat family=2 entries=23 >type=SYSCALL msg=audit(1406108629.195:1766): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=21b0910 items=0 ppid=28888 pid=28927 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.196:1767): table=nat family=2 entries=24 >type=SYSCALL msg=audit(1406108629.196:1767): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1a80ab0 items=0 ppid=28888 pid=28928 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108629.422:1768): table=filter family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108629.422:1768): table=mangle family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108629.422:1768): table=nat family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108629.422:1768): table=filter family=10 entries=0 >type=SYSCALL msg=audit(1406108629.422:1768): arch=c000003e syscall=56 success=yes exit=28979 a0=6c020011 a1=7fcd3c0a7380 a2=8 a3=30000a7373 items=0 ppid=1 pid=28899 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=SYSCALL msg=audit(1406108629.422:1769): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7fcd3c0a7380 a2=8 a3=30000a7373 items=0 ppid=28899 pid=28979 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=FD_PAIR msg=audit(1406108629.422:1769): fd0=0 fd1=0 >type=MAC_STATUS msg=audit(1406108642.482:1770): enforcing=1 old_enforcing=0 auid=0 ses=73 >type=SYSCALL msg=audit(1406108642.482:1770): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff95faa040 a2=1 a3=7fff95fa8dc0 items=0 ppid=28703 pid=28980 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=73 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) >type=USER_CMD msg=audit(1406108718.315:1771): user pid=29023 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108718.315:1772): user pid=29023 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108718.316:1773): user pid=29023 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108718.348:1774): user pid=29023 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108718.348:1775): user pid=29023 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108718.359:1776): user pid=29026 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108718.359:1777): user pid=29026 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108718.359:1778): user pid=29026 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108718.390:1779): user pid=29026 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108718.391:1780): user pid=29026 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108718.845:1781): user pid=29031 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108718.845:1782): user pid=29031 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108718.845:1783): user pid=29031 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108718.887:1784): user pid=29031 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108718.887:1785): user pid=29031 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108718.898:1786): user pid=29035 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108718.898:1787): user pid=29035 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108718.898:1788): user pid=29035 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108718.924:1789): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108718.924:1789): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=10823c0 items=0 ppid=29036 pid=29037 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108718.925:1790): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108718.925:1790): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1082100 items=0 ppid=29036 pid=29037 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108718.926:1791): table=filter family=2 entries=41 >type=SYSCALL msg=audit(1406108718.926:1791): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1087540 items=0 ppid=29036 pid=29037 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406108718.929:1792): user pid=29035 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108718.929:1793): user pid=29035 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108719.225:1794): user pid=29040 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29040 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108719.225:1795): user pid=29040 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29040 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108719.226:1796): user pid=29039 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=29040 suid=74 rport=44383 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108719.226:1797): user pid=29039 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=29040 suid=74 rport=44383 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=AVC msg=audit(1406108719.283:1798): avc: denied { search } for pid=29039 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406108719.283:1798): arch=c000003e syscall=2 success=no exit=-13 a0=7f21557b3550 a1=800 a2=1 a3=c items=0 ppid=15168 pid=29039 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=AVC msg=audit(1406108719.283:1799): avc: denied { search } for pid=29039 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406108719.283:1799): arch=c000003e syscall=2 success=no exit=-13 a0=7f21557b3550 a1=800 a2=1 a3=24 items=0 ppid=15168 pid=29039 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=USER_AUTH msg=audit(1406108719.283:1800): user pid=29039 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108719.283:1801): user pid=29039 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=none acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108719.284:1802): user pid=29039 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108719.284:1803): user pid=29039 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=CRYPTO_KEY_USER msg=audit(1406108719.285:1804): user pid=29039 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=29040 suid=74 rport=44383 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_ERR msg=audit(1406108719.498:1805): user pid=29039 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident acct="?" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=failed' >type=CRYPTO_KEY_USER msg=audit(1406108719.498:1806): user pid=29039 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29039 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108719.498:1807): user pid=29039 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29039 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_LOGIN msg=audit(1406108719.498:1808): user pid=29039 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_CMD msg=audit(1406108720.311:1809): user pid=29041 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108720.311:1810): user pid=29041 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108720.311:1811): user pid=29041 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108720.342:1812): user pid=29041 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108720.342:1813): user pid=29041 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108720.353:1814): user pid=29045 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108720.353:1815): user pid=29045 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108720.353:1816): user pid=29045 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108720.379:1817): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108720.379:1817): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=16153c0 items=0 ppid=29046 pid=29047 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108720.379:1818): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108720.379:1818): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1615100 items=0 ppid=29046 pid=29047 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108720.381:1819): table=filter family=2 entries=50 >type=SYSCALL msg=audit(1406108720.381:1819): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=161a390 items=0 ppid=29046 pid=29047 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406108720.384:1820): user pid=29045 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108720.384:1821): user pid=29045 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108772.995:1822): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108772.995:1822): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=e98aa0 items=0 ppid=29074 pid=29089 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108772.996:1823): table=nat family=2 entries=24 >type=SYSCALL msg=audit(1406108772.996:1823): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1148910 items=0 ppid=29074 pid=29090 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108772.998:1824): table=nat family=2 entries=23 >type=SYSCALL msg=audit(1406108772.998:1824): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=9525b0 items=0 ppid=29074 pid=29091 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108772.999:1825): table=filter family=2 entries=41 >type=SYSCALL msg=audit(1406108772.999:1825): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=184b000 items=0 ppid=29074 pid=29092 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.000:1826): table=filter family=2 entries=40 >type=SYSCALL msg=audit(1406108773.000:1826): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1c363d0 items=0 ppid=29074 pid=29093 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.002:1827): table=filter family=2 entries=39 >type=SYSCALL msg=audit(1406108773.002:1827): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2270260 items=0 ppid=29074 pid=29094 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.003:1828): table=filter family=2 entries=38 >type=SYSCALL msg=audit(1406108773.003:1828): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=148d520 items=0 ppid=29074 pid=29095 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.005:1829): table=filter family=2 entries=37 >type=SYSCALL msg=audit(1406108773.005:1829): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=f383b0 items=0 ppid=29074 pid=29096 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.006:1830): table=filter family=2 entries=36 >type=SYSCALL msg=audit(1406108773.006:1830): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=8eda80 items=0 ppid=29074 pid=29097 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.008:1831): table=filter family=2 entries=35 >type=SYSCALL msg=audit(1406108773.008:1831): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1e22910 items=0 ppid=29074 pid=29098 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.009:1832): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108773.009:1832): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1f9d120 items=0 ppid=29074 pid=29099 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.010:1833): table=filter family=2 entries=34 >type=SYSCALL msg=audit(1406108773.010:1833): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=19436d0 items=0 ppid=29074 pid=29100 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.012:1834): table=filter family=2 entries=33 >type=SYSCALL msg=audit(1406108773.012:1834): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1e00560 items=0 ppid=29074 pid=29101 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.013:1835): table=filter family=2 entries=32 >type=SYSCALL msg=audit(1406108773.013:1835): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=817560 items=0 ppid=29074 pid=29102 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.014:1836): table=filter family=2 entries=33 >type=SYSCALL msg=audit(1406108773.014:1836): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=11a46e0 items=0 ppid=29074 pid=29103 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.016:1837): table=mangle family=2 entries=9 >type=SYSCALL msg=audit(1406108773.016:1837): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=276b060 items=0 ppid=29074 pid=29104 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.017:1838): table=filter family=2 entries=34 >type=SYSCALL msg=audit(1406108773.017:1838): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=24c6910 items=0 ppid=29074 pid=29105 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.019:1839): table=filter family=2 entries=35 >type=SYSCALL msg=audit(1406108773.019:1839): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1429a90 items=0 ppid=29074 pid=29106 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.020:1840): table=filter family=2 entries=36 >type=SYSCALL msg=audit(1406108773.020:1840): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=22c13b0 items=0 ppid=29074 pid=29107 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.021:1841): table=filter family=2 entries=37 >type=SYSCALL msg=audit(1406108773.021:1841): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=14a7530 items=0 ppid=29074 pid=29108 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.022:1842): table=filter family=2 entries=38 >type=SYSCALL msg=audit(1406108773.022:1842): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=17dc260 items=0 ppid=29074 pid=29109 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.024:1843): table=filter family=2 entries=39 >type=SYSCALL msg=audit(1406108773.024:1843): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=278c3e0 items=0 ppid=29074 pid=29110 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.025:1844): table=filter family=2 entries=40 >type=SYSCALL msg=audit(1406108773.025:1844): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1a98010 items=0 ppid=29074 pid=29111 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.026:1845): table=nat family=2 entries=22 >type=SYSCALL msg=audit(1406108773.026:1845): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=cab5c0 items=0 ppid=29074 pid=29112 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.027:1846): table=nat family=2 entries=23 >type=SYSCALL msg=audit(1406108773.027:1846): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=11c1910 items=0 ppid=29074 pid=29113 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.029:1847): table=nat family=2 entries=24 >type=SYSCALL msg=audit(1406108773.029:1847): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=276cab0 items=0 ppid=29074 pid=29114 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108773.230:1848): table=filter family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108773.230:1848): table=mangle family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108773.230:1848): table=nat family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108773.230:1848): table=filter family=10 entries=0 >type=SYSCALL msg=audit(1406108773.230:1848): arch=c000003e syscall=56 success=yes exit=29165 a0=6c020011 a1=7f06f00ce2a0 a2=8 a3=30000a7373 items=0 ppid=1 pid=29085 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=SYSCALL msg=audit(1406108773.230:1849): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7f06f00ce2a0 a2=8 a3=30000a7373 items=0 ppid=29085 pid=29165 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=FD_PAIR msg=audit(1406108773.230:1849): fd0=0 fd1=0 >type=USER_CMD msg=audit(1406108784.521:1850): user pid=29206 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108784.521:1851): user pid=29206 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108784.521:1852): user pid=29206 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108784.553:1853): user pid=29206 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108784.553:1854): user pid=29206 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108784.564:1855): user pid=29209 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108784.564:1856): user pid=29209 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108784.564:1857): user pid=29209 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108784.593:1858): user pid=29209 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108784.593:1859): user pid=29209 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108785.046:1860): user pid=29214 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108785.046:1861): user pid=29214 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108785.046:1862): user pid=29214 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108785.085:1863): user pid=29214 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108785.085:1864): user pid=29214 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108785.096:1865): user pid=29218 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108785.096:1866): user pid=29218 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108785.096:1867): user pid=29218 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108785.122:1868): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108785.122:1868): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=278c3c0 items=0 ppid=29219 pid=29220 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108785.122:1869): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108785.122:1869): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=278c100 items=0 ppid=29219 pid=29220 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108785.124:1870): table=filter family=2 entries=41 >type=SYSCALL msg=audit(1406108785.124:1870): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2791540 items=0 ppid=29219 pid=29220 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406108785.127:1871): user pid=29218 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108785.127:1872): user pid=29218 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108785.178:1873): user pid=29223 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29223 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108785.178:1874): user pid=29223 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29223 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108785.180:1875): user pid=29222 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=29223 suid=74 rport=44384 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108785.180:1876): user pid=29222 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=29223 suid=74 rport=44384 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=AVC msg=audit(1406108785.235:1877): avc: denied { search } for pid=29222 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406108785.235:1877): arch=c000003e syscall=2 success=no exit=-13 a0=7f1bcc7df590 a1=800 a2=1 a3=c items=0 ppid=15168 pid=29222 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=AVC msg=audit(1406108785.235:1878): avc: denied { search } for pid=29222 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406108785.235:1878): arch=c000003e syscall=2 success=no exit=-13 a0=7f1bcc7df590 a1=800 a2=1 a3=24 items=0 ppid=15168 pid=29222 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=USER_AUTH msg=audit(1406108785.235:1879): user pid=29222 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108785.235:1880): user pid=29222 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=none acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108785.236:1881): user pid=29222 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108785.236:1882): user pid=29222 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=CRYPTO_KEY_USER msg=audit(1406108785.237:1883): user pid=29222 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=29223 suid=74 rport=44384 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_ERR msg=audit(1406108785.237:1884): user pid=29222 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident acct="?" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=failed' >type=CRYPTO_KEY_USER msg=audit(1406108785.238:1885): user pid=29222 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29222 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108785.238:1886): user pid=29222 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29222 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_LOGIN msg=audit(1406108785.238:1887): user pid=29222 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_CMD msg=audit(1406108786.070:1888): user pid=29224 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108786.074:1889): user pid=29224 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108786.075:1890): user pid=29224 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108786.105:1891): user pid=29224 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108786.106:1892): user pid=29224 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108786.117:1893): user pid=29228 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108786.117:1894): user pid=29228 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108786.117:1895): user pid=29228 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108786.143:1896): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108786.143:1896): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=c663c0 items=0 ppid=29229 pid=29230 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108786.143:1897): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108786.143:1897): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=c66100 items=0 ppid=29229 pid=29230 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108786.145:1898): table=filter family=2 entries=50 >type=SYSCALL msg=audit(1406108786.145:1898): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=c6b390 items=0 ppid=29229 pid=29230 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406108786.148:1899): user pid=29228 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108786.148:1900): user pid=29228 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108805.404:1901): user pid=29274 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108805.404:1902): user pid=29274 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108805.405:1903): user pid=29274 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108805.434:1904): user pid=29274 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108805.434:1905): user pid=29274 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108805.444:1906): user pid=29277 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108805.444:1907): user pid=29277 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108805.445:1908): user pid=29277 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108805.474:1909): user pid=29277 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108805.474:1910): user pid=29277 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108805.956:1911): user pid=29282 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108805.957:1912): user pid=29282 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108805.957:1913): user pid=29282 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108805.989:1914): user pid=29282 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108805.989:1915): user pid=29282 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108806.000:1916): user pid=29286 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108806.001:1917): user pid=29286 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108806.001:1918): user pid=29286 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108806.027:1919): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108806.027:1919): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=26c83c0 items=0 ppid=29287 pid=29288 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108806.027:1920): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108806.027:1920): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=26c8100 items=0 ppid=29287 pid=29288 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108806.029:1921): table=filter family=2 entries=41 >type=SYSCALL msg=audit(1406108806.029:1921): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=26cd540 items=0 ppid=29287 pid=29288 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406108806.032:1922): user pid=29286 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108806.032:1923): user pid=29286 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108806.084:1924): user pid=29291 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29291 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108806.084:1925): user pid=29291 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29291 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108806.084:1926): user pid=29290 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=29291 suid=74 rport=44385 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108806.084:1927): user pid=29290 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=29291 suid=74 rport=44385 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=AVC msg=audit(1406108806.139:1928): avc: denied { search } for pid=29290 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406108806.139:1928): arch=c000003e syscall=2 success=no exit=-13 a0=7fe003b5e590 a1=800 a2=1 a3=c items=0 ppid=15168 pid=29290 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=AVC msg=audit(1406108806.139:1929): avc: denied { search } for pid=29290 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406108806.139:1929): arch=c000003e syscall=2 success=no exit=-13 a0=7fe003b5e590 a1=800 a2=1 a3=24 items=0 ppid=15168 pid=29290 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=USER_AUTH msg=audit(1406108806.139:1930): user pid=29290 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108806.139:1931): user pid=29290 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=none acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108806.141:1932): user pid=29290 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108806.141:1933): user pid=29290 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=CRYPTO_KEY_USER msg=audit(1406108806.141:1934): user pid=29290 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=29291 suid=74 rport=44385 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_ERR msg=audit(1406108806.142:1935): user pid=29290 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident acct="?" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=failed' >type=CRYPTO_KEY_USER msg=audit(1406108806.142:1936): user pid=29290 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29290 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108806.142:1937): user pid=29290 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29290 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_LOGIN msg=audit(1406108806.142:1938): user pid=29290 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_CMD msg=audit(1406108806.971:1939): user pid=29292 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108806.972:1940): user pid=29292 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108806.972:1941): user pid=29292 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108807.002:1942): user pid=29292 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108807.003:1943): user pid=29292 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108807.013:1944): user pid=29296 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108807.013:1945): user pid=29296 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108807.014:1946): user pid=29296 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108807.040:1947): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108807.040:1947): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=27bc3c0 items=0 ppid=29297 pid=29298 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108807.040:1948): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108807.040:1948): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=27bc100 items=0 ppid=29297 pid=29298 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108807.041:1949): table=filter family=2 entries=50 >type=SYSCALL msg=audit(1406108807.041:1949): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=27c1390 items=0 ppid=29297 pid=29298 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406108807.045:1950): user pid=29296 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108807.045:1951): user pid=29296 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108866.381:1952): user pid=29338 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108866.382:1953): user pid=29338 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108866.382:1954): user pid=29338 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108866.411:1955): user pid=29338 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108866.411:1956): user pid=29338 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108866.421:1957): user pid=29341 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108866.421:1958): user pid=29341 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108866.421:1959): user pid=29341 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108866.450:1960): user pid=29341 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108866.450:1961): user pid=29341 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108866.885:1962): user pid=29346 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108866.885:1963): user pid=29346 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108866.885:1964): user pid=29346 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108866.918:1965): user pid=29346 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108866.918:1966): user pid=29346 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108866.929:1967): user pid=29350 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108866.929:1968): user pid=29350 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108866.929:1969): user pid=29350 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108866.955:1970): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108866.955:1970): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=279b3c0 items=0 ppid=29351 pid=29352 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108866.955:1971): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108866.955:1971): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=279b100 items=0 ppid=29351 pid=29352 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108866.957:1972): table=filter family=2 entries=41 >type=SYSCALL msg=audit(1406108866.957:1972): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=27a0540 items=0 ppid=29351 pid=29352 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406108866.961:1973): user pid=29350 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108866.961:1974): user pid=29350 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108867.014:1975): user pid=29355 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29355 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108867.015:1976): user pid=29355 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29355 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108867.015:1977): user pid=29354 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=29355 suid=74 rport=44386 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108867.015:1978): user pid=29354 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=29355 suid=74 rport=44386 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=AVC msg=audit(1406108867.074:1979): avc: denied { search } for pid=29354 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406108867.074:1979): arch=c000003e syscall=2 success=no exit=-13 a0=7f73dff4e570 a1=800 a2=1 a3=c items=0 ppid=15168 pid=29354 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=AVC msg=audit(1406108867.074:1980): avc: denied { search } for pid=29354 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406108867.074:1980): arch=c000003e syscall=2 success=no exit=-13 a0=7f73dff4e570 a1=800 a2=1 a3=24 items=0 ppid=15168 pid=29354 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=USER_AUTH msg=audit(1406108867.074:1981): user pid=29354 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108867.074:1982): user pid=29354 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=none acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108867.075:1983): user pid=29354 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108867.075:1984): user pid=29354 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=CRYPTO_KEY_USER msg=audit(1406108867.075:1985): user pid=29354 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=29355 suid=74 rport=44386 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_ERR msg=audit(1406108867.076:1986): user pid=29354 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident acct="?" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=failed' >type=CRYPTO_KEY_USER msg=audit(1406108867.077:1987): user pid=29354 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29354 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108867.077:1988): user pid=29354 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29354 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_LOGIN msg=audit(1406108867.077:1989): user pid=29354 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_CMD msg=audit(1406108867.950:1990): user pid=29356 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108867.950:1991): user pid=29356 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108867.950:1992): user pid=29356 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108867.981:1993): user pid=29356 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108867.981:1994): user pid=29356 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108867.992:1995): user pid=29360 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108867.992:1996): user pid=29360 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108867.993:1997): user pid=29360 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108868.019:1998): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108868.019:1998): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=19923c0 items=0 ppid=29361 pid=29362 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108868.019:1999): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108868.019:1999): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1992100 items=0 ppid=29361 pid=29362 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108868.020:2000): table=filter family=2 entries=50 >type=SYSCALL msg=audit(1406108868.020:2000): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1997390 items=0 ppid=29361 pid=29362 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406108868.023:2001): user pid=29360 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108868.024:2002): user pid=29360 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108879.603:2003): user pid=29403 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108879.603:2004): user pid=29403 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108879.604:2005): user pid=29403 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108879.632:2006): user pid=29403 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108879.632:2007): user pid=29403 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108879.642:2008): user pid=29406 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108879.643:2009): user pid=29406 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108879.643:2010): user pid=29406 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108879.673:2011): user pid=29406 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108879.673:2012): user pid=29406 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108880.104:2013): user pid=29411 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108880.104:2014): user pid=29411 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108880.104:2015): user pid=29411 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108880.135:2016): user pid=29411 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108880.135:2017): user pid=29411 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108880.146:2018): user pid=29415 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108880.146:2019): user pid=29415 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108880.146:2020): user pid=29415 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108880.172:2021): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108880.172:2021): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=117d3c0 items=0 ppid=29416 pid=29417 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108880.172:2022): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108880.172:2022): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=117d100 items=0 ppid=29416 pid=29417 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108880.175:2023): table=filter family=2 entries=41 >type=SYSCALL msg=audit(1406108880.175:2023): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1182540 items=0 ppid=29416 pid=29417 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406108880.178:2024): user pid=29415 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108880.178:2025): user pid=29415 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108880.225:2026): user pid=29420 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29420 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108880.225:2027): user pid=29420 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29420 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108880.226:2028): user pid=29419 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=29420 suid=74 rport=44387 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406108880.226:2029): user pid=29419 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=29420 suid=74 rport=44387 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=AVC msg=audit(1406108880.281:2030): avc: denied { search } for pid=29419 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406108880.281:2030): arch=c000003e syscall=2 success=no exit=-13 a0=7faf47170550 a1=800 a2=1 a3=c items=0 ppid=15168 pid=29419 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=AVC msg=audit(1406108880.281:2031): avc: denied { search } for pid=29419 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406108880.281:2031): arch=c000003e syscall=2 success=no exit=-13 a0=7faf47170550 a1=800 a2=1 a3=24 items=0 ppid=15168 pid=29419 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=USER_AUTH msg=audit(1406108880.281:2032): user pid=29419 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108880.281:2033): user pid=29419 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=none acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108880.282:2034): user pid=29419 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_AUTH msg=audit(1406108880.282:2035): user pid=29419 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=CRYPTO_KEY_USER msg=audit(1406108880.282:2036): user pid=29419 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=29420 suid=74 rport=44387 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_ERR msg=audit(1406108880.283:2037): user pid=29419 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident acct="?" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=failed' >type=CRYPTO_KEY_USER msg=audit(1406108880.283:2038): user pid=29419 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29419 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406108880.283:2039): user pid=29419 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29419 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_LOGIN msg=audit(1406108880.283:2040): user pid=29419 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=failed' >type=USER_CMD msg=audit(1406108881.090:2041): user pid=29421 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108881.091:2042): user pid=29421 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108881.091:2043): user pid=29421 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406108881.121:2044): user pid=29421 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108881.121:2045): user pid=29421 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406108881.132:2046): user pid=29425 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406108881.133:2047): user pid=29425 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406108881.133:2048): user pid=29425 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108881.159:2049): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108881.159:2049): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1f473c0 items=0 ppid=29426 pid=29427 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108881.159:2050): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108881.159:2050): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1f47100 items=0 ppid=29426 pid=29427 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108881.160:2051): table=filter family=2 entries=50 >type=SYSCALL msg=audit(1406108881.160:2051): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1f4c390 items=0 ppid=29426 pid=29427 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406108881.164:2052): user pid=29425 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406108881.164:2053): user pid=29425 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406108954.539:2054): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406108954.539:2054): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=26efaa0 items=0 ppid=29453 pid=29468 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.541:2055): table=nat family=2 entries=24 >type=SYSCALL msg=audit(1406108954.541:2055): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=9eb910 items=0 ppid=29453 pid=29469 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.543:2056): table=nat family=2 entries=23 >type=SYSCALL msg=audit(1406108954.543:2056): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=23805b0 items=0 ppid=29453 pid=29470 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.544:2057): table=filter family=2 entries=41 >type=SYSCALL msg=audit(1406108954.544:2057): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=116e000 items=0 ppid=29453 pid=29471 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.545:2058): table=filter family=2 entries=40 >type=SYSCALL msg=audit(1406108954.545:2058): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1e583d0 items=0 ppid=29453 pid=29472 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.546:2059): table=filter family=2 entries=39 >type=SYSCALL msg=audit(1406108954.546:2059): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2022260 items=0 ppid=29453 pid=29473 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.548:2060): table=filter family=2 entries=38 >type=SYSCALL msg=audit(1406108954.548:2060): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=19de520 items=0 ppid=29453 pid=29474 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.549:2061): table=filter family=2 entries=37 >type=SYSCALL msg=audit(1406108954.549:2061): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1d523b0 items=0 ppid=29453 pid=29475 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.550:2062): table=filter family=2 entries=36 >type=SYSCALL msg=audit(1406108954.550:2062): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=17c4a80 items=0 ppid=29453 pid=29476 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.552:2063): table=filter family=2 entries=35 >type=SYSCALL msg=audit(1406108954.552:2063): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=203b910 items=0 ppid=29453 pid=29477 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.553:2064): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406108954.553:2064): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2401120 items=0 ppid=29453 pid=29478 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.554:2065): table=filter family=2 entries=34 >type=SYSCALL msg=audit(1406108954.554:2065): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=27266d0 items=0 ppid=29453 pid=29479 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.556:2066): table=filter family=2 entries=33 >type=SYSCALL msg=audit(1406108954.556:2066): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2518560 items=0 ppid=29453 pid=29480 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.557:2067): table=filter family=2 entries=32 >type=SYSCALL msg=audit(1406108954.557:2067): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1616560 items=0 ppid=29453 pid=29481 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.558:2068): table=filter family=2 entries=33 >type=SYSCALL msg=audit(1406108954.558:2068): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=22d26e0 items=0 ppid=29453 pid=29482 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.560:2069): table=mangle family=2 entries=9 >type=SYSCALL msg=audit(1406108954.560:2069): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=15ce060 items=0 ppid=29453 pid=29483 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.561:2070): table=filter family=2 entries=34 >type=SYSCALL msg=audit(1406108954.561:2070): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2538910 items=0 ppid=29453 pid=29484 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.562:2071): table=filter family=2 entries=35 >type=SYSCALL msg=audit(1406108954.562:2071): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1b7da90 items=0 ppid=29453 pid=29485 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.563:2072): table=filter family=2 entries=36 >type=SYSCALL msg=audit(1406108954.563:2072): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1c5e3b0 items=0 ppid=29453 pid=29486 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.565:2073): table=filter family=2 entries=37 >type=SYSCALL msg=audit(1406108954.565:2073): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=181a530 items=0 ppid=29453 pid=29487 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.566:2074): table=filter family=2 entries=38 >type=SYSCALL msg=audit(1406108954.566:2074): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1917260 items=0 ppid=29453 pid=29488 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.567:2075): table=filter family=2 entries=39 >type=SYSCALL msg=audit(1406108954.567:2075): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=d593e0 items=0 ppid=29453 pid=29489 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.568:2076): table=filter family=2 entries=40 >type=SYSCALL msg=audit(1406108954.568:2076): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1d1a010 items=0 ppid=29453 pid=29490 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.570:2077): table=nat family=2 entries=22 >type=SYSCALL msg=audit(1406108954.570:2077): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=16825c0 items=0 ppid=29453 pid=29491 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.571:2078): table=nat family=2 entries=23 >type=SYSCALL msg=audit(1406108954.571:2078): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1a59910 items=0 ppid=29453 pid=29492 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.573:2079): table=nat family=2 entries=24 >type=SYSCALL msg=audit(1406108954.573:2079): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=2578ab0 items=0 ppid=29453 pid=29493 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="iptables" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406108954.796:2080): table=filter family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108954.796:2080): table=mangle family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108954.796:2080): table=nat family=2 entries=0 >type=NETFILTER_CFG msg=audit(1406108954.796:2080): table=filter family=10 entries=0 >type=SYSCALL msg=audit(1406108954.796:2080): arch=c000003e syscall=56 success=yes exit=29544 a0=6c020011 a1=7fc6f80f4910 a2=8 a3=30000a7373 items=0 ppid=1 pid=29464 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=SYSCALL msg=audit(1406108954.796:2081): arch=c000003e syscall=56 success=yes exit=0 a0=6c020011 a1=7fc6f80f4910 a2=8 a3=30000a7373 items=0 ppid=29464 pid=29544 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=FD_PAIR msg=audit(1406108954.796:2081): fd0=0 fd1=0 >type=USER_ACCT msg=audit(1406109001.716:2082): user pid=29547 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406109001.716:2083): user pid=29547 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406109001.717:2084): pid=29547 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=75 >type=USER_START msg=audit(1406109001.725:2085): user pid=29547 uid=0 auid=0 ses=75 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406109001.787:2086): user pid=29547 uid=0 auid=0 ses=75 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406109001.787:2087): user pid=29547 uid=0 auid=0 ses=75 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=MAC_STATUS msg=audit(1406109002.459:2088): enforcing=0 old_enforcing=1 auid=0 ses=73 >type=SYSCALL msg=audit(1406109002.459:2088): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff58d0a560 a2=1 a3=7fff58d092e0 items=0 ppid=28703 pid=29550 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=73 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) >type=USER_CMD msg=audit(1406109024.526:2089): user pid=29590 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109024.526:2090): user pid=29590 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406109024.526:2091): user pid=29590 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406109024.559:2092): user pid=29590 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406109024.559:2093): user pid=29590 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406109024.569:2094): user pid=29593 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109024.569:2095): user pid=29593 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406109024.570:2096): user pid=29593 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406109024.599:2097): user pid=29593 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406109024.599:2098): user pid=29593 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406109025.065:2099): user pid=29598 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109025.065:2100): user pid=29598 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406109025.065:2101): user pid=29598 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406109025.107:2102): user pid=29598 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406109025.107:2103): user pid=29598 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406109025.118:2104): user pid=29602 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109025.118:2105): user pid=29602 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406109025.118:2106): user pid=29602 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406109025.145:2107): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406109025.145:2107): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=b973c0 items=0 ppid=29603 pid=29604 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406109025.146:2108): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406109025.146:2108): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=b97100 items=0 ppid=29603 pid=29604 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406109025.147:2109): table=filter family=2 entries=41 >type=SYSCALL msg=audit(1406109025.147:2109): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=b9c540 items=0 ppid=29603 pid=29604 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406109025.151:2110): user pid=29602 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406109025.151:2111): user pid=29602 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406109025.271:2112): user pid=29607 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29607 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406109025.271:2113): user pid=29607 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29607 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406109025.273:2114): user pid=29606 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=29607 suid=74 rport=44389 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406109025.273:2115): user pid=29606 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=29607 suid=74 rport=44389 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=AVC msg=audit(1406109025.328:2116): avc: denied { search } for pid=29606 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=AVC msg=audit(1406109025.328:2116): avc: denied { read } for pid=29606 comm="sshd" name="authorized_keys" dev=dm-0 ino=395431 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file >type=AVC msg=audit(1406109025.328:2116): avc: denied { open } for pid=29606 comm="sshd" name="authorized_keys" dev=dm-0 ino=395431 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file >type=SYSCALL msg=audit(1406109025.328:2116): arch=c000003e syscall=2 success=yes exit=4 a0=7fcef8817570 a1=800 a2=1 a3=c items=0 ppid=15168 pid=29606 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=AVC msg=audit(1406109025.329:2117): avc: denied { getattr } for pid=29606 comm="sshd" path="/var/lib/nova/.ssh/authorized_keys" dev=dm-0 ino=395431 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file >type=SYSCALL msg=audit(1406109025.329:2117): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7fff6020b340 a2=7fff6020b340 a3=c items=0 ppid=15168 pid=29606 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=AVC msg=audit(1406109025.329:2118): avc: denied { getattr } for pid=29606 comm="sshd" path="/var/lib/nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406109025.329:2118): arch=c000003e syscall=6 success=yes exit=0 a0=7fff6020c3d0 a1=7fff6020b1d0 a2=7fff6020b1d0 a3=22 items=0 ppid=15168 pid=29606 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=USER_AUTH msg=audit(1406109025.329:2119): user pid=29606 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=44389 acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_AUTH msg=audit(1406109025.329:2120): user pid=29606 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=91:58:6f:e0:55:20:c9:33:dd:fb:4c:87:e2:a8:08:f8 rport=44389 acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_ACCT msg=audit(1406109027.397:2121): user pid=29606 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406109027.397:2122): user pid=29606 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=29607 suid=74 rport=44389 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_AUTH msg=audit(1406109027.398:2123): user pid=29606 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406109027.398:2124): user pid=29606 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=LOGIN msg=audit(1406109027.398:2125): pid=29606 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=162 old ses=16 new ses=76 >type=USER_ROLE_CHANGE msg=audit(1406109027.473:2126): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=USER_START msg=audit(1406109027.484:2127): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406109027.485:2128): user pid=29609 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29609 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406109027.485:2129): user pid=29609 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29609 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406109027.485:2130): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=29606 suid=0 rport=44389 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109027.486:2131): user pid=29609 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406109027.490:2132): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=USER_START msg=audit(1406109027.491:2133): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406109027.496:2134): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=29609 suid=162 rport=44389 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_END msg=audit(1406109027.497:2135): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406109027.498:2136): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=USER_END msg=audit(1406109027.499:2137): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406109027.499:2138): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406109027.499:2139): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29606 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406109027.499:2140): user pid=29606 uid=0 auid=162 ses=76 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29606 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_CMD msg=audit(1406109028.384:2141): user pid=29611 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109028.385:2142): user pid=29611 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406109028.385:2143): user pid=29611 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406109028.430:2144): user pid=29611 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406109028.431:2145): user pid=29611 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406109028.441:2146): user pid=29615 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109028.442:2147): user pid=29615 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406109028.442:2148): user pid=29615 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406109028.468:2149): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406109028.468:2149): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=10533c0 items=0 ppid=29616 pid=29617 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406109028.468:2150): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406109028.468:2150): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1053100 items=0 ppid=29616 pid=29617 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406109028.469:2151): table=filter family=2 entries=50 >type=SYSCALL msg=audit(1406109028.469:2151): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=1058390 items=0 ppid=29616 pid=29617 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406109028.473:2152): user pid=29615 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406109028.474:2153): user pid=29615 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406109083.115:2154): user pid=29661 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E6620627263746C2061646469662062723130302065746830 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109083.115:2155): user pid=29661 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406109083.115:2156): user pid=29661 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406109083.148:2157): user pid=29661 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406109083.148:2158): user pid=29661 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406109083.162:2159): user pid=29664 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E66206970206C696E6B207365742065746830207570 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109083.162:2160): user pid=29664 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406109083.162:2161): user pid=29664 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406109083.194:2162): user pid=29664 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406109083.194:2163): user pid=29664 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406109083.646:2164): user pid=29669 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D73617665202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109083.646:2165): user pid=29669 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406109083.646:2166): user pid=29669 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406109083.684:2167): user pid=29669 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406109083.685:2168): user pid=29669 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_CMD msg=audit(1406109083.695:2169): user pid=29673 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662069707461626C65732D726573746F7265202D63 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109083.696:2170): user pid=29673 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406109083.696:2171): user pid=29673 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=NETFILTER_CFG msg=audit(1406109083.722:2172): table=nat family=2 entries=25 >type=SYSCALL msg=audit(1406109083.722:2172): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=12e63c0 items=0 ppid=29674 pid=29675 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406109083.722:2173): table=mangle family=2 entries=10 >type=SYSCALL msg=audit(1406109083.722:2173): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=12e6100 items=0 ppid=29674 pid=29675 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=NETFILTER_CFG msg=audit(1406109083.724:2174): table=filter family=2 entries=41 >type=SYSCALL msg=audit(1406109083.724:2174): arch=c000003e syscall=54 success=yes exit=0 a0=3 a1=0 a2=40 a3=12eb540 items=0 ppid=29674 pid=29675 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iptables-restor" exe="/sbin/iptables-multi-1.4.7" subj=unconfined_u:system_r:iptables_t:s0-s0:c0.c1023 key=(null) >type=USER_END msg=audit(1406109083.727:2175): user pid=29673 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406109083.727:2176): user pid=29673 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406109083.785:2177): user pid=29678 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29678 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406109083.785:2178): user pid=29678 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29678 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406109083.787:2179): user pid=29677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=29678 suid=74 rport=44390 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406109083.787:2180): user pid=29677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=29678 suid=74 rport=44390 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=AVC msg=audit(1406109083.843:2181): avc: denied { search } for pid=29677 comm="sshd" name="nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=AVC msg=audit(1406109083.843:2181): avc: denied { read } for pid=29677 comm="sshd" name="authorized_keys" dev=dm-0 ino=395431 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file >type=AVC msg=audit(1406109083.843:2181): avc: denied { open } for pid=29677 comm="sshd" name="authorized_keys" dev=dm-0 ino=395431 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file >type=SYSCALL msg=audit(1406109083.843:2181): arch=c000003e syscall=2 success=yes exit=4 a0=7f0d742c8550 a1=800 a2=1 a3=c items=0 ppid=15168 pid=29677 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=AVC msg=audit(1406109083.843:2182): avc: denied { getattr } for pid=29677 comm="sshd" path="/var/lib/nova/.ssh/authorized_keys" dev=dm-0 ino=395431 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=file >type=SYSCALL msg=audit(1406109083.843:2182): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7fffc6e758f0 a2=7fffc6e758f0 a3=c items=0 ppid=15168 pid=29677 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=AVC msg=audit(1406109083.843:2183): avc: denied { getattr } for pid=29677 comm="sshd" path="/var/lib/nova" dev=dm-0 ino=395096 scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nova_var_lib_t:s0 tclass=dir >type=SYSCALL msg=audit(1406109083.843:2183): arch=c000003e syscall=6 success=yes exit=0 a0=7fffc6e76980 a1=7fffc6e75780 a2=7fffc6e75780 a3=22 items=0 ppid=15168 pid=29677 auid=0 uid=0 gid=0 euid=162 suid=0 fsuid=162 egid=162 sgid=0 fsgid=162 tty=(none) ses=16 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) >type=USER_AUTH msg=audit(1406109083.843:2184): user pid=29677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=44390 acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_AUTH msg=audit(1406109083.843:2185): user pid=29677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=91:58:6f:e0:55:20:c9:33:dd:fb:4c:87:e2:a8:08:f8 rport=44390 acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_ACCT msg=audit(1406109083.848:2186): user pid=29677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406109083.848:2187): user pid=29677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=29678 suid=74 rport=44390 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_AUTH msg=audit(1406109083.849:2188): user pid=29677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="nova" exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406109083.850:2189): user pid=29677 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=LOGIN msg=audit(1406109083.850:2190): pid=29677 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=162 old ses=16 new ses=77 >type=USER_ROLE_CHANGE msg=audit(1406109083.923:2191): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=USER_START msg=audit(1406109083.939:2192): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406109083.940:2193): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=29677 suid=0 rport=44390 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406109083.940:2194): user pid=29680 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29680 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406109083.940:2195): user pid=29680 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29680 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109083.941:2196): user pid=29680 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406109083.946:2197): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=USER_START msg=audit(1406109083.946:2198): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=VIRT_MACHINE_ID msg=audit(1406109084.033:2199): user pid=29453 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 vm-ctx=unconfined_u:system_r:svirt_t:s0:c574,c756 img-ctx=unconfined_u:object_r:svirt_image_t:s0:c574,c756 model=selinux exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_MACHINE_ID msg=audit(1406109084.033:2200): user pid=29453 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 vm-ctx=107:107 img-ctx=107:107 model=dac exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=ANOM_PROMISCUOUS msg=audit(1406109084.050:2201): dev=vnet0 prom=256 old_prom=0 auid=0 uid=0 gid=0 ses=73 >type=SYSCALL msg=audit(1406109084.050:2201): arch=c000003e syscall=16 success=yes exit=0 a0=1c a1=89a2 a2=7fc706a69af0 a3=7fc706a69850 items=0 ppid=1 pid=29454 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=73 comm="libvirtd" exe="/usr/sbin/libvirtd" subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null) >type=VIRT_RESOURCE msg=audit(1406109084.060:2202): user pid=29453 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=net reason=open vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 net=FA:16:3E:36:8F:1B path="/dev/net/tun" rdev=0A:C8 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_RESOURCE msg=audit(1406109084.215:2203): user pid=29453 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=net reason=open vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 net=FA:16:3E:36:8F:1B path="/dev/vhost-net" rdev=0A:39 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_RESOURCE msg=audit(1406109084.504:2204): user pid=29453 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=disk reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-disk="?" new-disk="/var/lib/nova/instances/8c02e375-acb8-4231-80fa-bf36e529c560/disk" exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_RESOURCE msg=audit(1406109084.504:2205): user pid=29453 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=net reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-net=? new-net=FA:16:3E:36:8F:1B exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_RESOURCE msg=audit(1406109084.504:2206): user pid=29453 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=mem reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-mem=0 new-mem=2097152 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_RESOURCE msg=audit(1406109084.504:2207): user pid=29453 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm resrc=vcpu reason=start vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 old-vcpu=0 new-vcpu=1 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=VIRT_CONTROL msg=audit(1406109084.504:2208): user pid=29453 uid=0 auid=0 ses=73 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm op=start reason=migrated vm="instance-00000001" uuid=8c02e375-acb8-4231-80fa-bf36e529c560 vm-pid=29905 exe="/usr/sbin/libvirtd" hostname=? addr=? terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406109282.486:2209): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=29680 suid=162 rport=44390 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_END msg=audit(1406109282.490:2210): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406109282.491:2211): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="nova" exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=USER_END msg=audit(1406109282.491:2212): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406109282.492:2213): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=162 exe="/usr/sbin/sshd" hostname=cloud-qe-12.idm.lab.bos.redhat.com addr=10.16.96.103 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406109282.492:2214): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=29677 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406109282.492:2215): user pid=29677 uid=0 auid=162 ses=77 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=29677 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.16.96.103 terminal=? res=success' >type=USER_ACCT msg=audit(1406109601.810:2216): user pid=29963 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406109601.810:2217): user pid=29963 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406109601.815:2218): pid=29963 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=78 >type=USER_START msg=audit(1406109601.821:2219): user pid=29963 uid=0 auid=0 ses=78 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406109601.892:2220): user pid=29963 uid=0 auid=0 ses=78 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406109601.892:2221): user pid=29963 uid=0 auid=0 ses=78 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_ACCT msg=audit(1406109661.900:2222): user pid=29970 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406109661.900:2223): user pid=29970 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406109661.901:2224): pid=29970 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=79 >type=USER_START msg=audit(1406109661.908:2225): user pid=29970 uid=0 auid=0 ses=79 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406109661.925:2226): user pid=29970 uid=0 auid=0 ses=79 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406109661.925:2227): user pid=29970 uid=0 auid=0 ses=79 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_CMD msg=audit(1406109854.274:2228): user pid=29998 uid=162 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='cwd="/" cmd=6E6F76612D726F6F7477726170202F6574632F6E6F76612F726F6F74777261702E636F6E662063686F776E20313632202F7661722F6C69622F6E6F76612F696E7374616E6365732F5F626173652F62396464383331326664666235306636643464346463383166326462353832373162396330396331 terminal=? res=success' >type=CRED_ACQ msg=audit(1406109854.275:2229): user pid=29998 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_START msg=audit(1406109854.275:2230): user pid=29998 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_END msg=audit(1406109854.305:2231): user pid=29998 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=CRED_DISP msg=audit(1406109854.305:2232): user pid=29998 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:virtd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/bin/sudo" hostname=? addr=? terminal=? res=success' >type=USER_ACCT msg=audit(1406110201.929:2233): user pid=30039 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_ACQ msg=audit(1406110201.930:2234): user pid=30039 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=LOGIN msg=audit(1406110201.930:2235): pid=30039 uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old auid=4294967295 new auid=0 old ses=4294967295 new ses=80 >type=USER_START msg=audit(1406110201.936:2236): user pid=30039 uid=0 auid=0 ses=80 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRED_DISP msg=audit(1406110201.980:2237): user pid=30039 uid=0 auid=0 ses=80 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=USER_END msg=audit(1406110201.980:2238): user pid=30039 uid=0 auid=0 ses=80 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success' >type=CRYPTO_KEY_USER msg=audit(1406110236.165:2239): user pid=30047 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=30047 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406110236.165:2240): user pid=30047 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=30047 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406110236.495:2241): user pid=30046 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=30047 suid=74 rport=52282 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406110236.496:2242): user pid=30046 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=30047 suid=74 rport=52282 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406110252.712:2243): user pid=30046 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52282 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406110252.713:2244): user pid=30046 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=30:fc:fa:a3:71:ac:1b:8b:03:8b:4e:4b:5f:37:dc:af rport=52282 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_ACCT msg=audit(1406110252.718:2245): user pid=30046 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406110252.719:2246): user pid=30046 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=30047 suid=74 rport=52282 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406110252.719:2247): user pid=30046 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406110252.724:2248): user pid=30046 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=LOGIN msg=audit(1406110252.724:2249): pid=30046 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=81 >type=USER_ROLE_CHANGE msg=audit(1406110252.797:2250): user pid=30046 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_START msg=audit(1406110252.812:2251): user pid=30046 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406110253.229:2252): user pid=30046 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_START msg=audit(1406110253.229:2253): user pid=30046 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406110253.230:2254): user pid=30049 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=30049 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406110253.230:2255): user pid=30049 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=30049 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRED_REFR msg=audit(1406110253.231:2256): user pid=30049 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_END msg=audit(1406110255.037:2257): user pid=30046 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_LOGOUT msg=audit(1406110255.038:2258): user pid=30046 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_END msg=audit(1406110255.039:2259): user pid=30046 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=CRED_DISP msg=audit(1406110255.040:2260): user pid=30046 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406110255.040:2261): user pid=30046 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=30046 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406110255.040:2262): user pid=30046 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=30046 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406110255.040:2263): user pid=30046 uid=0 auid=0 ses=81 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=30046 suid=0 rport=52282 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406110322.294:2264): user pid=30061 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=30061 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406110322.294:2265): user pid=30061 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=30061 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406110322.558:2266): user pid=30060 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 spid=30061 suid=74 rport=52288 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_SESSION msg=audit(1406110322.559:2267): user pid=30060 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 spid=30061 suid=74 rport=52288 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406110338.540:2268): user pid=30060 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=52288 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406110338.540:2269): user pid=30060 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=30:fc:fa:a3:71:ac:1b:8b:03:8b:4e:4b:5f:37:dc:af rport=52288 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_ACCT msg=audit(1406110338.545:2270): user pid=30060 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406110338.545:2271): user pid=30060 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=30061 suid=74 rport=52288 laddr=10.16.96.102 lport=22 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=USER_AUTH msg=audit(1406110338.546:2272): user pid=30060 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=ssh res=success' >type=CRED_ACQ msg=audit(1406110338.546:2273): user pid=30060 uid=0 auid=0 ses=16 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=LOGIN msg=audit(1406110338.546:2274): pid=30060 uid=0 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 old auid=0 new auid=0 old ses=16 new ses=82 >type=USER_ROLE_CHANGE msg=audit(1406110338.613:2275): user pid=30060 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_START msg=audit(1406110338.623:2276): user pid=30060 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_LOGIN msg=audit(1406110339.056:2277): user pid=30060 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=USER_START msg=audit(1406110339.056:2278): user pid=30060 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success' >type=CRYPTO_KEY_USER msg=audit(1406110339.057:2279): user pid=30063 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=4f:1e:a7:bf:45:db:c9:cc:93:3d:ab:94:88:5a:30:77 direction=? spid=30063 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRYPTO_KEY_USER msg=audit(1406110339.057:2280): user pid=30063 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=87:36:63:93:a7:63:d4:86:7a:0b:d7:7f:ed:f3:c6:12 direction=? spid=30063 suid=0 exe="/usr/sbin/sshd" hostname=? addr=10.3.238.151 terminal=? res=success' >type=CRED_REFR msg=audit(1406110339.058:2281): user pid=30063 uid=0 auid=0 ses=82 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-238-151.phx2.redhat.com addr=10.3.238.151 terminal=ssh res=success'
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=920190">View the attachment on a separate page</a>.</b>
View Attachment As Raw
Actions:
View
Attachments on
bug 1122457
:
920186
|
920187
|
920189
| 920190