Attachment 934441 Details for Bug 1117673 – audit log

audit log

audit.log (text/plain), 75.07 KB, created by Ade Lee on 2014-09-04 13:47:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ade Lee

Created: 2014-09-04 13:47:28 UTC

Size: 75.07 KB

patch

obsolete

>type=AVC msg=audit(1409769210.701:12687): avc:  denied  { read } for  pid=3118 comm="pkidaemon" name="CS.cfg.bak" dev="dm-0" ino=656409 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409769210.701:12687): arch=c000003e syscall=4 success=no exit=-13 a0=14fdbb0 a1=7fffb6e849d0 a2=7fffb6e849d0 a3=8 items=0 ppid=1 pid=3118 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409769210.701:12688): avc:  denied  { getattr } for  pid=3118 comm="pkidaemon" path="/etc/pki/pki-tomcat/ca/CS.cfg.bak" dev="dm-0" ino=656409 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409769210.701:12688): arch=c000003e syscall=6 success=no exit=-13 a0=14fdbb0 a1=7fffb6e848c0 a2=7fffb6e848c0 a3=8 items=0 ppid=1 pid=3118 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409769210.725:12689): avc:  denied  { setfscreate } for  pid=3350 comm="cp" scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:system_r:pki_tomcat_t:s0 tclass=process
>type=SYSCALL msg=audit(1409769210.725:12689): arch=c000003e syscall=1 success=no exit=-13 a0=3 a1=14b6b30 a2=29 a3=7fffe796b550 items=0 ppid=3118 pid=3350 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="cp" exe="/usr/bin/cp" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409769210.726:12690): avc:  denied  { relabelfrom } for  pid=3350 comm="cp" name="CS.cfg.bak.20140903143330" dev="dm-0" ino=654503 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=file
>type=SYSCALL msg=audit(1409769210.726:12690): arch=c000003e syscall=190 success=no exit=-13 a0=4 a1=7fffe796b6f0 a2=14b68f0 a3=29 items=0 ppid=3118 pid=3350 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="cp" exe="/usr/bin/cp" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409769210.730:12691): avc:  denied  { read } for  pid=3351 comm="ln" name="CS.cfg.bak" dev="dm-0" ino=656409 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409769210.730:12691): arch=c000003e syscall=4 success=no exit=-13 a0=7fff536ccb03 a1=7fff536cc300 a2=7fff536cc300 a3=7fff536cc080 items=0 ppid=3118 pid=3351 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="ln" exe="/usr/bin/ln" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409769210.732:12692): avc:  denied  { read } for  pid=3118 comm="pkidaemon" name="CS.cfg.bak" dev="dm-0" ino=656409 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409769210.732:12692): arch=c000003e syscall=4 success=no exit=-13 a0=14fc1a0 a1=7fffb6e84ef0 a2=7fffb6e84ef0 a3=8 items=0 ppid=1 pid=3118 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409769210.737:12693): avc:  denied  { read } for  pid=3118 comm="pkidaemon" name="CS.cfg.bak" dev="dm-0" ino=656418 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409769210.737:12693): arch=c000003e syscall=4 success=no exit=-13 a0=14fc1a0 a1=7fffb6e849d0 a2=7fffb6e849d0 a3=8 items=0 ppid=1 pid=3118 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409769210.737:12694): avc:  denied  { getattr } for  pid=3118 comm="pkidaemon" path="/etc/pki/pki-tomcat/kra/CS.cfg.bak" dev="dm-0" ino=656418 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409769210.737:12694): arch=c000003e syscall=6 success=no exit=-13 a0=14fc1a0 a1=7fffb6e848c0 a2=7fffb6e848c0 a3=8 items=0 ppid=1 pid=3118 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409769210.760:12695): avc:  denied  { setfscreate } for  pid=3357 comm="cp" scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:system_r:pki_tomcat_t:s0 tclass=process
>type=SYSCALL msg=audit(1409769210.760:12695): arch=c000003e syscall=1 success=no exit=-13 a0=3 a1=1f49b30 a2=29 a3=7fff58f8b6c0 items=0 ppid=3118 pid=3357 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="cp" exe="/usr/bin/cp" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409769210.761:12696): avc:  denied  { relabelfrom } for  pid=3357 comm="cp" name="CS.cfg.bak.20140903143330" dev="dm-0" ino=654504 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=file
>type=SYSCALL msg=audit(1409769210.761:12696): arch=c000003e syscall=190 success=no exit=-13 a0=4 a1=7fff58f8b860 a2=1f498f0 a3=29 items=0 ppid=3118 pid=3357 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="cp" exe="/usr/bin/cp" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409769210.765:12697): avc:  denied  { read } for  pid=3358 comm="ln" name="CS.cfg.bak" dev="dm-0" ino=656418 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409769210.765:12697): arch=c000003e syscall=4 success=no exit=-13 a0=7fff810e9b02 a1=7fff810e7a70 a2=7fff810e7a70 a3=7fff810e77f0 items=0 ppid=3118 pid=3358 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="ln" exe="/usr/bin/ln" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409769210.768:12698): avc:  denied  { read } for  pid=3118 comm="pkidaemon" name="CS.cfg.bak" dev="dm-0" ino=656418 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409769210.768:12698): arch=c000003e syscall=4 success=no exit=-13 a0=14f5770 a1=7fffb6e84ef0 a2=7fffb6e84ef0 a3=8 items=0 ppid=1 pid=3118 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=SERVICE_START msg=audit(1409769210.788:12699): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="pki-tomcatd@pki-tomcat" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
>type=MAC_STATUS msg=audit(1409769239.118:12700): enforcing=0 old_enforcing=1 auid=0 ses=1303
>type=SYSCALL msg=audit(1409769239.118:12700): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff000cac80 a2=1 a3=7fff000caa40 items=0 ppid=32469 pid=3370 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1303 tty=pts0 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_AVC msg=audit(1409769247.119:12701): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received setenforce notice (enforcing=0)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
>type=AVC msg=audit(1409769248.230:12702): avc:  denied  { read } for  pid=3373 comm="pkidaemon" name="CS.cfg.bak" dev="dm-0" ino=656409 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409769248.230:12702): arch=c000003e syscall=4 success=yes exit=0 a0=2526bb0 a1=7fff708c1580 a2=7fff708c1580 a3=8 items=0 ppid=1 pid=3373 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=SERVICE_START msg=audit(1409769248.251:12703): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="pki-tomcatd@pki-tomcat" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1409770861.384:12704): pid=3965 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409770861.384:12705): pid=3965 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409770861.385:12706): login pid=3965 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1304
>type=USER_START msg=audit(1409770861.411:12707): pid=3965 uid=0 auid=0 ses=1304 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409770861.414:12708): pid=3965 uid=0 auid=0 ses=1304 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409770861.484:12709): pid=3965 uid=0 auid=0 ses=1304 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409770861.487:12710): pid=3965 uid=0 auid=0 ses=1304 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409774461.535:12711): pid=4521 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409774461.535:12712): pid=4521 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409774461.537:12713): login pid=4521 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1305
>type=USER_START msg=audit(1409774461.556:12714): pid=4521 uid=0 auid=0 ses=1305 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409774461.558:12715): pid=4521 uid=0 auid=0 ses=1305 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409774461.621:12716): pid=4521 uid=0 auid=0 ses=1305 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409774461.623:12717): pid=4521 uid=0 auid=0 ses=1305 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409778061.670:12718): pid=5078 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409778061.671:12719): pid=5078 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409778061.671:12720): login pid=5078 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1306
>type=USER_START msg=audit(1409778061.684:12721): pid=5078 uid=0 auid=0 ses=1306 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409778061.692:12722): pid=5078 uid=0 auid=0 ses=1306 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409778061.754:12723): pid=5078 uid=0 auid=0 ses=1306 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409778061.756:12724): pid=5078 uid=0 auid=0 ses=1306 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRYPTO_KEY_USER msg=audit(1409778602.994:12725): pid=5171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:77:ee:2e:6a:2d:57:7e:29:59:31:68:38:64:4f:4b direction=? spid=5171 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409778602.994:12726): pid=5171 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ea:65:92:10:8e:04:4e:7a:7f:fd:57:48:72:73:8c:53 direction=? spid=5171 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1409778603.033:12727): pid=5170 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=5171 suid=74 rport=44478 laddr=10. exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1409778603.033:12728): pid=5170 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=5171 suid=74 rport=44478 laddr=10. exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=USER_AUTH msg=audit(1409778603.439:12729): pid=5170 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409778603.499:12730): pid=5170 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409778603.553:12731): pid=5170 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409778603.610:12732): pid=5170 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=44478 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=USER_AUTH msg=audit(1409778603.610:12733): pid=5170 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=a0:f3:33:ad:04:0d:94:34:49:22:38:7a:30:a8:6e:bc rport=44478 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=USER_ACCT msg=audit(1409778603.648:12734): pid=5170 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=vpn-61-194.rdu2.redhat.com addr=10.10.61.194 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1409778603.649:12735): pid=5170 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=5171 suid=74 rport=44478 laddr=10.16.78.40 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=USER_AUTH msg=audit(1409778603.653:12736): pid=5170 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1409778603.657:12737): pid=5170 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-61-194.rdu2.redhat.com addr=10.10.61.194 terminal=ssh res=success'
>type=LOGIN msg=audit(1409778603.657:12738): login pid=5170 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1307
>type=USER_ROLE_CHANGE msg=audit(1409778603.748:12739): pid=5170 uid=0 auid=0 ses=1307 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=vpn-61-194.rdu2.redhat.com addr=10.10.61.194 terminal=ssh res=success'
>type=USER_START msg=audit(1409778603.775:12740): pid=5170 uid=0 auid=0 ses=1307 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=vpn-61-194.rdu2.redhat.com addr=10.10.61.194 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1409778603.826:12741): pid=5177 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-61-194.rdu2.redhat.com addr=10.10.61.194 terminal=/dev/pts/1 res=success'
>type=USER_START msg=audit(1409778603.827:12742): pid=5177 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=vpn-61-194.rdu2.redhat.com addr=10.10.61.194 terminal=/dev/pts/1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1409778603.828:12743): pid=5177 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:77:ee:2e:6a:2d:57:7e:29:59:31:68:38:64:4f:4b direction=? spid=5177 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=pts/1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1409778603.828:12744): pid=5177 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ea:65:92:10:8e:04:4e:7a:7f:fd:57:48:72:73:8c:53 direction=? spid=5177 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=pts/1 res=success'
>type=CRED_REFR msg=audit(1409778603.833:12745): pid=5177 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-61-194.rdu2.redhat.com addr=10.10.61.194 terminal=ssh res=success'
>type=SERVICE_STOP msg=audit(1409778857.578:12746): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="pki-tomcatd@pki-tomcat" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=MAC_STATUS msg=audit(1409778870.194:12747): enforcing=1 old_enforcing=0 auid=0 ses=1307
>type=SYSCALL msg=audit(1409778870.194:12747): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff6cf0dbc0 a2=1 a3=7fff6cf0d980 items=0 ppid=5177 pid=5320 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1307 tty=pts1 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_AVC msg=audit(1409778876.204:12748): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received setenforce notice (enforcing=1)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
>type=AVC msg=audit(1409778877.334:12749): avc:  denied  { read } for  pid=5323 comm="pkidaemon" name="CS.cfg.bak" dev="dm-0" ino=656409 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409778877.334:12749): arch=c000003e syscall=4 success=no exit=-13 a0=2773bb0 a1=7fff40147940 a2=7fff40147940 a3=8 items=0 ppid=1 pid=5323 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409778877.334:12750): avc:  denied  { getattr } for  pid=5323 comm="pkidaemon" path="/etc/pki/pki-tomcat/ca/CS.cfg.bak" dev="dm-0" ino=656409 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409778877.334:12750): arch=c000003e syscall=6 success=no exit=-13 a0=2773bb0 a1=7fff40147830 a2=7fff40147830 a3=8 items=0 ppid=1 pid=5323 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409778877.361:12751): avc:  denied  { setfscreate } for  pid=5547 comm="cp" scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:system_r:pki_tomcat_t:s0 tclass=process
>type=SYSCALL msg=audit(1409778877.361:12751): arch=c000003e syscall=1 success=no exit=-13 a0=3 a1=1910b30 a2=29 a3=7fffd85ab480 items=0 ppid=5323 pid=5547 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="cp" exe="/usr/bin/cp" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409778877.362:12752): avc:  denied  { relabelfrom } for  pid=5547 comm="cp" name="CS.cfg.bak.20140903171437" dev="dm-0" ino=654508 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=file
>type=SYSCALL msg=audit(1409778877.362:12752): arch=c000003e syscall=190 success=no exit=-13 a0=4 a1=7fffd85ab620 a2=19108f0 a3=29 items=0 ppid=5323 pid=5547 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="cp" exe="/usr/bin/cp" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409778877.366:12753): avc:  denied  { read } for  pid=5548 comm="ln" name="CS.cfg.bak" dev="dm-0" ino=656409 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409778877.366:12753): arch=c000003e syscall=4 success=no exit=-13 a0=7fffbfd5ab03 a1=7fffbfd5a2b0 a2=7fffbfd5a2b0 a3=7fffbfd5a030 items=0 ppid=5323 pid=5548 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="ln" exe="/usr/bin/ln" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409778877.369:12754): avc:  denied  { read } for  pid=5323 comm="pkidaemon" name="CS.cfg.bak" dev="dm-0" ino=656409 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409778877.369:12754): arch=c000003e syscall=4 success=no exit=-13 a0=27721a0 a1=7fff40147e60 a2=7fff40147e60 a3=8 items=0 ppid=1 pid=5323 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409778877.375:12755): avc:  denied  { read } for  pid=5323 comm="pkidaemon" name="CS.cfg.bak" dev="dm-0" ino=656418 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409778877.375:12755): arch=c000003e syscall=4 success=no exit=-13 a0=27721a0 a1=7fff40147940 a2=7fff40147940 a3=8 items=0 ppid=1 pid=5323 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409778877.375:12756): avc:  denied  { getattr } for  pid=5323 comm="pkidaemon" path="/etc/pki/pki-tomcat/kra/CS.cfg.bak" dev="dm-0" ino=656418 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409778877.375:12756): arch=c000003e syscall=6 success=no exit=-13 a0=27721a0 a1=7fff40147830 a2=7fff40147830 a3=8 items=0 ppid=1 pid=5323 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409778877.400:12757): avc:  denied  { setfscreate } for  pid=5554 comm="cp" scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:system_r:pki_tomcat_t:s0 tclass=process
>type=SYSCALL msg=audit(1409778877.400:12757): arch=c000003e syscall=1 success=no exit=-13 a0=3 a1=108ab30 a2=29 a3=7fffee1441d0 items=0 ppid=5323 pid=5554 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="cp" exe="/usr/bin/cp" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409778877.401:12758): avc:  denied  { relabelfrom } for  pid=5554 comm="cp" name="CS.cfg.bak.20140903171437" dev="dm-0" ino=654509 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=file
>type=SYSCALL msg=audit(1409778877.401:12758): arch=c000003e syscall=190 success=no exit=-13 a0=4 a1=7fffee144370 a2=108a8f0 a3=29 items=0 ppid=5323 pid=5554 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="cp" exe="/usr/bin/cp" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409778877.405:12759): avc:  denied  { read } for  pid=5555 comm="ln" name="CS.cfg.bak" dev="dm-0" ino=656418 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409778877.405:12759): arch=c000003e syscall=4 success=no exit=-13 a0=7fff21f30b02 a1=7fff21f303a0 a2=7fff21f303a0 a3=7fff21f30120 items=0 ppid=5323 pid=5555 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="ln" exe="/usr/bin/ln" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=AVC msg=audit(1409778877.408:12760): avc:  denied  { read } for  pid=5323 comm="pkidaemon" name="CS.cfg.bak" dev="dm-0" ino=656418 scontext=system_u:system_r:pki_tomcat_t:s0 tcontext=system_u:object_r:pki_tomcat_etc_rw_t:s0 tclass=lnk_file
>type=SYSCALL msg=audit(1409778877.408:12760): arch=c000003e syscall=4 success=no exit=-13 a0=276b770 a1=7fff40147e60 a2=7fff40147e60 a3=8 items=0 ppid=1 pid=5323 auid=4294967295 uid=17 gid=17 euid=17 suid=17 fsuid=17 egid=17 sgid=17 fsgid=17 ses=4294967295 tty=(none) comm="pkidaemon" exe="/usr/bin/bash" subj=system_u:system_r:pki_tomcat_t:s0 key=(null)
>type=SERVICE_START msg=audit(1409778877.435:12761): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="pki-tomcatd@pki-tomcat" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
>type=MAC_STATUS msg=audit(1409778928.573:12762): enforcing=0 old_enforcing=1 auid=0 ses=1307
>type=SYSCALL msg=audit(1409778928.573:12762): arch=c000003e syscall=1 success=yes exit=1 a0=3 a1=7fff0db43cf0 a2=1 a3=7fff0db43ab0 items=0 ppid=5177 pid=5570 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=1307 tty=pts1 comm="setenforce" exe="/usr/sbin/setenforce" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
>type=USER_ACCT msg=audit(1409781661.817:12763): pid=5975 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409781661.818:12764): pid=5975 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409781661.819:12765): login pid=5975 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1308
>type=USER_AVC msg=audit(1409781661.830:12766): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc:  received setenforce notice (enforcing=0)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
>type=USER_START msg=audit(1409781661.844:12767): pid=5975 uid=0 auid=0 ses=1308 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409781661.846:12768): pid=5975 uid=0 auid=0 ses=1308 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409781661.919:12769): pid=5975 uid=0 auid=0 ses=1308 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409781661.921:12770): pid=5975 uid=0 auid=0 ses=1308 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409785261.980:12771): pid=6522 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409785261.980:12772): pid=6522 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409785261.982:12773): login pid=6522 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1309
>type=USER_START msg=audit(1409785262.000:12774): pid=6522 uid=0 auid=0 ses=1309 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409785262.002:12775): pid=6522 uid=0 auid=0 ses=1309 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409785262.066:12776): pid=6522 uid=0 auid=0 ses=1309 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409785262.068:12777): pid=6522 uid=0 auid=0 ses=1309 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409788861.116:12778): pid=7073 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409788861.116:12779): pid=7073 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409788861.117:12780): login pid=7073 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1310
>type=USER_START msg=audit(1409788861.131:12781): pid=7073 uid=0 auid=0 ses=1310 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409788861.133:12782): pid=7073 uid=0 auid=0 ses=1310 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409788861.197:12783): pid=7073 uid=0 auid=0 ses=1310 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409788861.198:12784): pid=7073 uid=0 auid=0 ses=1310 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409792461.248:12785): pid=7621 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409792461.249:12786): pid=7621 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409792461.249:12787): login pid=7621 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1311
>type=USER_START msg=audit(1409792461.266:12788): pid=7621 uid=0 auid=0 ses=1311 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409792461.267:12789): pid=7621 uid=0 auid=0 ses=1311 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409792461.322:12790): pid=7621 uid=0 auid=0 ses=1311 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409792461.324:12791): pid=7621 uid=0 auid=0 ses=1311 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409796061.369:12792): pid=8172 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409796061.369:12793): pid=8172 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409796061.370:12794): login pid=8172 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1312
>type=USER_START msg=audit(1409796061.386:12795): pid=8172 uid=0 auid=0 ses=1312 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409796061.387:12796): pid=8172 uid=0 auid=0 ses=1312 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409796061.462:12797): pid=8172 uid=0 auid=0 ses=1312 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409796061.464:12798): pid=8172 uid=0 auid=0 ses=1312 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409799661.508:12799): pid=8721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409799661.508:12800): pid=8721 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409799661.508:12801): login pid=8721 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1313
>type=USER_START msg=audit(1409799661.522:12802): pid=8721 uid=0 auid=0 ses=1313 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409799661.523:12803): pid=8721 uid=0 auid=0 ses=1313 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409799661.574:12804): pid=8721 uid=0 auid=0 ses=1313 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409799661.575:12805): pid=8721 uid=0 auid=0 ses=1313 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409803261.620:12806): pid=9270 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409803261.620:12807): pid=9270 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409803261.621:12808): login pid=9270 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1314
>type=USER_START msg=audit(1409803261.635:12809): pid=9270 uid=0 auid=0 ses=1314 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409803261.637:12810): pid=9270 uid=0 auid=0 ses=1314 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409803261.710:12811): pid=9270 uid=0 auid=0 ses=1314 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409803261.713:12812): pid=9270 uid=0 auid=0 ses=1314 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=SERVICE_START msg=audit(1409804848.537:12813): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-tmpfiles-clean" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=SERVICE_STOP msg=audit(1409804848.537:12814): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm="systemd-tmpfiles-clean" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
>type=USER_ACCT msg=audit(1409806861.780:12815): pid=9823 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409806861.780:12816): pid=9823 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409806861.781:12817): login pid=9823 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1315
>type=USER_START msg=audit(1409806861.802:12818): pid=9823 uid=0 auid=0 ses=1315 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409806861.805:12819): pid=9823 uid=0 auid=0 ses=1315 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409806861.875:12820): pid=9823 uid=0 auid=0 ses=1315 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409806861.877:12821): pid=9823 uid=0 auid=0 ses=1315 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409810461.930:12822): pid=10407 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409810461.930:12823): pid=10407 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409810461.931:12824): login pid=10407 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1316
>type=USER_START msg=audit(1409810461.959:12825): pid=10407 uid=0 auid=0 ses=1316 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409810461.962:12826): pid=10407 uid=0 auid=0 ses=1316 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409810462.046:12827): pid=10407 uid=0 auid=0 ses=1316 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409810462.049:12828): pid=10407 uid=0 auid=0 ses=1316 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409814061.094:12829): pid=10959 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409814061.094:12830): pid=10959 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409814061.095:12831): login pid=10959 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1317
>type=USER_START msg=audit(1409814061.112:12832): pid=10959 uid=0 auid=0 ses=1317 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409814061.114:12833): pid=10959 uid=0 auid=0 ses=1317 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409814061.181:12834): pid=10959 uid=0 auid=0 ses=1317 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409814061.183:12835): pid=10959 uid=0 auid=0 ses=1317 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409817661.239:12836): pid=11531 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409817661.240:12837): pid=11531 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409817661.242:12838): login pid=11531 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1318
>type=USER_START msg=audit(1409817661.274:12839): pid=11531 uid=0 auid=0 ses=1318 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409817661.280:12840): pid=11531 uid=0 auid=0 ses=1318 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409817661.352:12841): pid=11531 uid=0 auid=0 ses=1318 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409817661.354:12842): pid=11531 uid=0 auid=0 ses=1318 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409821261.398:12843): pid=12080 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409821261.399:12844): pid=12080 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409821261.400:12845): login pid=12080 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1319
>type=USER_START msg=audit(1409821261.414:12846): pid=12080 uid=0 auid=0 ses=1319 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409821261.416:12847): pid=12080 uid=0 auid=0 ses=1319 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409821261.471:12848): pid=12080 uid=0 auid=0 ses=1319 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409821261.473:12849): pid=12080 uid=0 auid=0 ses=1319 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409824861.518:12850): pid=12629 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409824861.519:12851): pid=12629 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409824861.519:12852): login pid=12629 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1320
>type=USER_START msg=audit(1409824861.535:12853): pid=12629 uid=0 auid=0 ses=1320 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409824861.538:12854): pid=12629 uid=0 auid=0 ses=1320 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409824861.597:12855): pid=12629 uid=0 auid=0 ses=1320 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409824861.626:12856): pid=12629 uid=0 auid=0 ses=1320 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409828461.677:12857): pid=13180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409828461.678:12858): pid=13180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409828461.679:12859): login pid=13180 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1321
>type=USER_START msg=audit(1409828461.693:12860): pid=13180 uid=0 auid=0 ses=1321 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409828461.695:12861): pid=13180 uid=0 auid=0 ses=1321 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409828461.763:12862): pid=13180 uid=0 auid=0 ses=1321 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409828461.765:12863): pid=13180 uid=0 auid=0 ses=1321 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_ACCT msg=audit(1409832061.810:12864): pid=13730 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409832061.810:12865): pid=13730 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409832061.811:12866): login pid=13730 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1322
>type=USER_START msg=audit(1409832061.824:12867): pid=13730 uid=0 auid=0 ses=1322 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409832061.833:12868): pid=13730 uid=0 auid=0 ses=1322 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409832061.896:12869): pid=13730 uid=0 auid=0 ses=1322 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409832061.898:12870): pid=13730 uid=0 auid=0 ses=1322 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409835092.450:12871): pid=32462 uid=0 auid=0 ses=1303 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=vpn-61-194.rdu2.redhat.com addr=10.10.61.194 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1409835092.451:12872): pid=32462 uid=0 auid=0 ses=1303 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-61-194.rdu2.redhat.com addr=10.10.61.194 terminal=ssh res=success'
>type=USER_END msg=audit(1409835092.454:12873): pid=32462 uid=0 auid=0 ses=1303 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=USER_LOGOUT msg=audit(1409835092.454:12874): pid=32462 uid=0 auid=0 ses=1303 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1409835092.455:12875): pid=32462 uid=0 auid=0 ses=1303 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:77:ee:2e:6a:2d:57:7e:29:59:31:68:38:64:4f:4b direction=? spid=32462 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409835092.455:12876): pid=32462 uid=0 auid=0 ses=1303 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ea:65:92:10:8e:04:4e:7a:7f:fd:57:48:72:73:8c:53 direction=? spid=32462 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409835092.455:12877): pid=32462 uid=0 auid=0 ses=1303 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=32462 suid=0 rport=44358 laddr=10.16.78.40 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=USER_ACCT msg=audit(1409835661.947:12878): pid=14279 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_ACQ msg=audit(1409835661.947:12879): pid=14279 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=LOGIN msg=audit(1409835661.948:12880): login pid=14279 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1323
>type=USER_START msg=audit(1409835661.971:12881): pid=14279 uid=0 auid=0 ses=1323 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_REFR msg=audit(1409835661.973:12882): pid=14279 uid=0 auid=0 ses=1323 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=CRED_DISP msg=audit(1409835662.043:12883): pid=14279 uid=0 auid=0 ses=1323 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409835662.046:12884): pid=14279 uid=0 auid=0 ses=1323 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
>type=USER_END msg=audit(1409837287.902:12885): pid=5170 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=vpn-61-194.rdu2.redhat.com addr=10.10.61.194 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1409837287.903:12886): pid=5170 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=vpn-61-194.rdu2.redhat.com addr=10.10.61.194 terminal=ssh res=success'
>type=USER_END msg=audit(1409837287.905:12887): pid=5170 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/1 res=success'
>type=USER_LOGOUT msg=audit(1409837287.906:12888): pid=5170 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=? addr=? terminal=/dev/pts/1 res=success'
>type=CRYPTO_KEY_USER msg=audit(1409837287.906:12889): pid=5170 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:77:ee:2e:6a:2d:57:7e:29:59:31:68:38:64:4f:4b direction=? spid=5170 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409837287.906:12890): pid=5170 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ea:65:92:10:8e:04:4e:7a:7f:fd:57:48:72:73:8c:53 direction=? spid=5170 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409837287.907:12891): pid=5170 uid=0 auid=0 ses=1307 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=5170 suid=0 rport=44478 laddr=10.16.78.40 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.10.61.194 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838283.180:12892): pid=14682 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:77:ee:2e:6a:2d:57:7e:29:59:31:68:38:64:4f:4b direction=? spid=14682 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838283.181:12893): pid=14682 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ea:65:92:10:8e:04:4e:7a:7f:fd:57:48:72:73:8c:53 direction=? spid=14682 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1409838283.198:12894): pid=14681 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=14682 suid=74 rport=37623 laddr=10 exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1409838283.198:12895): pid=14681 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=14682 suid=74 rport=37623 laddr=10 exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_AUTH msg=audit(1409838283.492:12896): pid=14681 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409838283.531:12897): pid=14681 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409838283.574:12898): pid=14681 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409838283.615:12899): pid=14681 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=37623 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_AUTH msg=audit(1409838283.615:12900): pid=14681 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=a0:f3:33:ad:04:0d:94:34:49:22:38:7a:30:a8:6e:bc rport=37623 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_ACCT msg=audit(1409838283.627:12901): pid=14681 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838283.629:12902): pid=14681 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=14682 suid=74 rport=37623 laddr=10.16.78.40 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_AUTH msg=audit(1409838283.633:12903): pid=14681 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1409838283.634:12904): pid=14681 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=LOGIN msg=audit(1409838283.634:12905): login pid=14681 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1324
>type=USER_ROLE_CHANGE msg=audit(1409838283.720:12906): pid=14681 uid=0 auid=0 ses=1324 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=USER_START msg=audit(1409838283.752:12907): pid=14681 uid=0 auid=0 ses=1324 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1409838283.786:12908): pid=14688 uid=0 auid=0 ses=1324 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=/dev/pts/0 res=success'
>type=USER_START msg=audit(1409838283.786:12909): pid=14688 uid=0 auid=0 ses=1324 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=/dev/pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838283.787:12910): pid=14688 uid=0 auid=0 ses=1324 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:77:ee:2e:6a:2d:57:7e:29:59:31:68:38:64:4f:4b direction=? spid=14688 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=pts/0 res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838283.787:12911): pid=14688 uid=0 auid=0 ses=1324 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ea:65:92:10:8e:04:4e:7a:7f:fd:57:48:72:73:8c:53 direction=? spid=14688 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=pts/0 res=success'
>type=CRED_REFR msg=audit(1409838283.790:12912): pid=14688 uid=0 auid=0 ses=1324 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838378.847:12913): pid=14737 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:77:ee:2e:6a:2d:57:7e:29:59:31:68:38:64:4f:4b direction=? spid=14737 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838378.848:12914): pid=14737 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ea:65:92:10:8e:04:4e:7a:7f:fd:57:48:72:73:8c:53 direction=? spid=14737 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1409838378.864:12915): pid=14736 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=14737 suid=74 rport=37630 laddr=10 exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1409838378.864:12916): pid=14736 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=14737 suid=74 rport=37630 laddr=10 exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_AUTH msg=audit(1409838379.048:12917): pid=14736 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409838379.087:12918): pid=14736 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409838379.125:12919): pid=14736 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409838379.164:12920): pid=14736 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=37630 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_AUTH msg=audit(1409838379.165:12921): pid=14736 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=a0:f3:33:ad:04:0d:94:34:49:22:38:7a:30:a8:6e:bc rport=37630 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_ACCT msg=audit(1409838379.178:12922): pid=14736 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838379.181:12923): pid=14736 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=14737 suid=74 rport=37630 laddr=10.16.78.40 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_AUTH msg=audit(1409838379.185:12924): pid=14736 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1409838379.185:12925): pid=14736 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=LOGIN msg=audit(1409838379.186:12926): login pid=14736 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1325
>type=USER_ROLE_CHANGE msg=audit(1409838379.267:12927): pid=14736 uid=0 auid=0 ses=1325 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=USER_START msg=audit(1409838379.290:12928): pid=14736 uid=0 auid=0 ses=1325 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1409838379.313:12929): pid=14736 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=USER_START msg=audit(1409838379.313:12930): pid=14736 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838379.316:12931): pid=14744 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:77:ee:2e:6a:2d:57:7e:29:59:31:68:38:64:4f:4b direction=? spid=14744 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838379.317:12932): pid=14744 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ea:65:92:10:8e:04:4e:7a:7f:fd:57:48:72:73:8c:53 direction=? spid=14744 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRED_REFR msg=audit(1409838379.321:12933): pid=14744 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=USER_END msg=audit(1409838379.384:12934): pid=14736 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=CRED_DISP msg=audit(1409838379.384:12935): pid=14736 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=USER_END msg=audit(1409838379.386:12936): pid=14736 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=USER_LOGOUT msg=audit(1409838379.386:12937): pid=14736 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838379.386:12938): pid=14736 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:77:ee:2e:6a:2d:57:7e:29:59:31:68:38:64:4f:4b direction=? spid=14736 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838379.387:12939): pid=14736 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ea:65:92:10:8e:04:4e:7a:7f:fd:57:48:72:73:8c:53 direction=? spid=14736 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838379.387:12940): pid=14736 uid=0 auid=0 ses=1325 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=14736 suid=0 rport=37630 laddr=10.16.78.40 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838397.474:12941): pid=14752 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:77:ee:2e:6a:2d:57:7e:29:59:31:68:38:64:4f:4b direction=? spid=14752 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838397.474:12942): pid=14752 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ea:65:92:10:8e:04:4e:7a:7f:fd:57:48:72:73:8c:53 direction=? spid=14752 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1409838397.491:12943): pid=14751 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=14752 suid=74 rport=37633 laddr=10 exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_SESSION msg=audit(1409838397.491:12944): pid=14751 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-server cipher=aes128-ctr ksize=128 mac=hmac-md5-etm@openssh.com spid=14752 suid=74 rport=37633 laddr=10 exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_AUTH msg=audit(1409838397.670:12945): pid=14751 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409838397.708:12946): pid=14751 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409838397.748:12947): pid=14751 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=failed'
>type=USER_AUTH msg=audit(1409838397.788:12948): pid=14751 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey_auth rport=37633 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_AUTH msg=audit(1409838397.788:12949): pid=14751 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=key algo=ssh-rsa size=2048 fp=a0:f3:33:ad:04:0d:94:34:49:22:38:7a:30:a8:6e:bc rport=37633 acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_ACCT msg=audit(1409838397.800:12950): pid=14751 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838397.801:12951): pid=14751 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=destroy kind=session fp=? direction=both spid=14752 suid=74 rport=37633 laddr=10.16.78.40 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=USER_AUTH msg=audit(1409838397.805:12952): pid=14751 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=ssh res=success'
>type=CRED_ACQ msg=audit(1409838397.806:12953): pid=14751 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=LOGIN msg=audit(1409838397.806:12954): login pid=14751 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1326
>type=USER_ROLE_CHANGE msg=audit(1409838397.887:12955): pid=14751 uid=0 auid=0 ses=1326 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=USER_START msg=audit(1409838397.908:12956): pid=14751 uid=0 auid=0 ses=1326 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=USER_LOGIN msg=audit(1409838397.930:12957): pid=14751 uid=0 auid=0 ses=1326 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=USER_START msg=audit(1409838397.931:12958): pid=14751 uid=0 auid=0 ses=1326 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838397.935:12959): pid=14758 uid=0 auid=0 ses=1326 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=48:77:ee:2e:6a:2d:57:7e:29:59:31:68:38:64:4f:4b direction=? spid=14758 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRYPTO_KEY_USER msg=audit(1409838397.935:12960): pid=14758 uid=0 auid=0 ses=1326 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=ea:65:92:10:8e:04:4e:7a:7f:fd:57:48:72:73:8c:53 direction=? spid=14758 suid=0  exe="/usr/sbin/sshd" hostname=? addr=10.13.57.62 terminal=? res=success'
>type=CRED_REFR msg=audit(1409838397.940:12961): pid=14758 uid=0 auid=0 ses=1326 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.13.57.62 addr=10.13.57.62 terminal=ssh res=success'

Actions: View

Attachments on bug 1117673: 916661 | 934441 | 940746 | 940749