xref: /aosp_15_r20/external/selinux/python/sepolgen/tests/audit.txt (revision 2d543d20722ada2425b5bdab9d0d1d29470e7bba)

type=AVC msg=audit(1158584779.745:708): avc:  denied  { dac_read_search } for  pid=8132 comm="sh" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=SYSCALL msg=audit(1158584779.745:708): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bf9132f8 a2=4c56cff4 a3=0 items=0 ppid=8131 pid=8132 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sh" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null)
type=AVC msg=audit(1158584779.753:709): avc:  denied  { dac_override } for  pid=8133 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=AVC msg=audit(1158584779.753:709): avc:  denied  { dac_read_search } for  pid=8133 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=SYSCALL msg=audit(1158584779.753:709): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bf910a48 a2=4c56cff4 a3=0 items=0 ppid=8132 pid=8133 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null)
type=AVC msg=audit(1158584779.825:710): avc:  denied  { dac_override } for  pid=8134 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=AVC msg=audit(1158584779.825:710): avc:  denied  { dac_read_search } for  pid=8134 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=SYSCALL msg=audit(1158584779.825:710): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bf910a48 a2=4c56cff4 a3=0 items=0 ppid=8132 pid=8134 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null)
type=AVC msg=audit(1158584780.793:711): avc:  denied  { dac_override } for  pid=8144 comm="sh" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=AVC msg=audit(1158584780.793:711): avc:  denied  { dac_read_search } for  pid=8144 comm="sh" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=SYSCALL msg=audit(1158584780.793:711): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bfc0ba38 a2=4c56cff4 a3=0 items=0 ppid=8131 pid=8144 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="sh" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null)
type=AVC msg=audit(1158584780.797:712): avc:  denied  { dac_override } for  pid=8145 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=AVC msg=audit(1158584780.797:712): avc:  denied  { dac_read_search } for  pid=8145 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=SYSCALL msg=audit(1158584780.797:712): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bfc0b188 a2=4c56cff4 a3=0 items=0 ppid=8144 pid=8145 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null)
type=AVC msg=audit(1158584780.801:713): avc:  denied  { dac_override } for  pid=8146 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=AVC msg=audit(1158584780.801:713): avc:  denied  { dac_read_search } for  pid=8146 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=SYSCALL msg=audit(1158584780.801:713): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bfc0b188 a2=4c56cff4 a3=0 items=0 ppid=8144 pid=8146 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null)
type=AVC msg=audit(1158584780.805:714): avc:  denied  { dac_override } for  pid=8144 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=AVC msg=audit(1158584780.805:714): avc:  denied  { dac_read_search } for  pid=8144 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=SYSCALL msg=audit(1158584780.805:714): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bfc0a6c8 a2=4c56cff4 a3=0 items=0 ppid=8131 pid=8144 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null)
type=AVC msg=audit(1158584780.849:715): avc:  denied  { dac_override } for  pid=8152 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=AVC msg=audit(1158584780.849:715): avc:  denied  { dac_read_search } for  pid=8152 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=SYSCALL msg=audit(1158584780.849:715): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bfc0a0b8 a2=4c56cff4 a3=0 items=0 ppid=8151 pid=8152 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null)
type=AVC msg=audit(1158584780.853:716): avc:  denied  { dac_override } for  pid=8153 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=AVC msg=audit(1158584780.853:716): avc:  denied  { dac_read_search } for  pid=8153 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=SYSCALL msg=audit(1158584780.853:716): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bfc09c78 a2=4c56cff4 a3=0 items=0 ppid=8151 pid=8153 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null)
type=AVC msg=audit(1158584780.945:717): avc:  denied  { dac_override } for  pid=8144 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=AVC msg=audit(1158584780.945:717): avc:  denied  { dac_read_search } for  pid=8144 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=SYSCALL msg=audit(1158584780.945:717): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bfc09be8 a2=4c56cff4 a3=0 items=0 ppid=8131 pid=8144 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null)
type=AVC msg=audit(1158584780.957:718): avc:  denied  { dac_override } for  pid=8144 comm="vpnc-script" capability=1 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=AVC msg=audit(1158584780.957:718): avc:  denied  { dac_read_search } for  pid=8144 comm="vpnc-script" capability=2 scontext=user_u:system_r:vpnc_t:s0 tcontext=user_u:system_r:vpnc_t:s0 tclass=capability
type=SYSCALL msg=audit(1158584780.957:718): arch=40000003 syscall=195 success=no exit=-13 a0=80d2437 a1=bfc09be8 a2=4c56cff4 a3=0 items=0 ppid=8131 pid=8144 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) comm="vpnc-script" exe="/bin/bash" subj=user_u:system_r:vpnc_t:s0 key=(null)
type=CRED_ACQ msg=audit(1158584988.203:719): user pid=8264 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=? res=success)'
type=USER_START msg=audit(1158584988.203:720): user pid=8264 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=? res=success)'
type=USER_END msg=audit(1158584988.203:721): user pid=8264 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1158585001.341:722): user pid=8294 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158585001.341:723): login pid=8294 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158585001.341:724): user pid=8294 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158585001.345:725): user pid=8294 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158585001.397:726): user pid=8294 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158585001.397:727): user pid=8294 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158585033.003:728): user pid=8331 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=? res=success)'
type=USER_START msg=audit(1158585033.003:729): user pid=8331 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=? res=success)'
type=USER_END msg=audit(1158585033.003:730): user pid=8331 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session close acct=root : exe="/usr/bin/sudo" (hostname=?, addr=?, terminal=? res=success)'
type=USER_ACCT msg=audit(1158585601.463:731): user pid=8495 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158585601.463:732): login pid=8495 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158585601.463:733): user pid=8495 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158585601.463:734): user pid=8495 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158585601.483:735): user pid=8495 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158585601.483:736): user pid=8495 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158586201.552:737): user pid=8538 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158586201.552:738): login pid=8538 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158586201.552:739): user pid=8538 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158586201.556:740): user pid=8538 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158586201.576:741): user pid=8538 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158586201.576:742): user pid=8538 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158586801.646:743): user pid=8563 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158586801.650:744): login pid=8563 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158586801.650:745): user pid=8563 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158586801.650:746): user pid=8563 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158586801.670:747): user pid=8563 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158586801.670:748): user pid=8563 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158587401.735:749): user pid=8628 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158587401.735:750): login pid=8628 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158587401.739:751): user pid=8628 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158587401.739:752): user pid=8628 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158587401.759:753): user pid=8628 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158587401.759:754): user pid=8628 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158588001.825:755): user pid=8779 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158588001.825:756): login pid=8779 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158588001.825:757): user pid=8779 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158588001.825:758): user pid=8779 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158588001.885:759): user pid=8779 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158588001.885:760): user pid=8779 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158588061.896:761): user pid=8787 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158588061.900:762): login pid=8787 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158588061.900:763): user pid=8787 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158588061.900:764): user pid=8787 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158588061.920:765): user pid=8787 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158588061.920:766): user pid=8787 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_AUTH msg=audit(1158588251.786:767): user pid=8857 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c255 msg='PAM: authentication acct=kmacmill : exe="/usr/sbin/sshd" (hostname=192.168.1.102, addr=2.0.0.0, terminal=ssh res=success)'
type=USER_ACCT msg=audit(1158588251.786:768): user pid=8857 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c255 msg='PAM: accounting acct=kmacmill : exe="/usr/sbin/sshd" (hostname=192.168.1.102, addr=2.0.0.0, terminal=ssh res=success)'
type=LOGIN msg=audit(1158588251.790:769): login pid=8859 uid=0 old auid=4294967295 new auid=500
type=USER_START msg=audit(1158588251.790:770): user pid=8859 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c255 msg='PAM: session open acct=kmacmill : exe="/usr/sbin/sshd" (hostname=192.168.1.102, addr=2.0.0.0, terminal=ssh res=success)'
type=CRED_REFR msg=audit(1158588251.790:771): user pid=8859 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c255 msg='PAM: setcred acct=kmacmill : exe="/usr/sbin/sshd" (hostname=192.168.1.102, addr=2.0.0.0, terminal=ssh res=success)'
type=USER_AUTH msg=audit(1158588258.499:772): user pid=8877 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c255 msg='PAM: authentication acct=kmacmill : exe="/usr/sbin/sshd" (hostname=192.168.1.102, addr=2.0.0.0, terminal=ssh res=success)'
type=USER_ACCT msg=audit(1158588258.499:773): user pid=8877 uid=0 auid=4294967295 subj=system_u:system_r:unconfined_t:s0-s0:c0.c255 msg='PAM: accounting acct=kmacmill : exe="/usr/sbin/sshd" (hostname=192.168.1.102, addr=2.0.0.0, terminal=ssh res=success)'
type=LOGIN msg=audit(1158588258.503:774): login pid=8879 uid=0 old auid=4294967295 new auid=500
type=USER_START msg=audit(1158588258.503:775): user pid=8879 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c255 msg='PAM: session open acct=kmacmill : exe="/usr/sbin/sshd" (hostname=192.168.1.102, addr=2.0.0.0, terminal=ssh res=success)'
type=CRED_REFR msg=audit(1158588258.503:776): user pid=8879 uid=0 auid=500 subj=system_u:system_r:unconfined_t:s0-s0:c0.c255 msg='PAM: setcred acct=kmacmill : exe="/usr/sbin/sshd" (hostname=192.168.1.102, addr=2.0.0.0, terminal=ssh res=success)'
type=USER_ACCT msg=audit(1158588601.986:777): user pid=8933 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158588601.986:778): login pid=8933 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158588601.986:779): user pid=8933 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158588601.990:780): user pid=8933 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158588602.010:781): user pid=8933 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158588602.010:782): user pid=8933 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158589201.084:783): user pid=8966 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158589201.084:784): login pid=8966 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158589201.084:785): user pid=8966 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158589201.084:786): user pid=8966 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158589201.104:787): user pid=8966 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158589201.104:788): user pid=8966 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158589801.165:789): user pid=9001 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158589801.165:790): login pid=9001 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158589801.169:791): user pid=9001 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158589801.169:792): user pid=9001 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158589801.189:793): user pid=9001 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158589801.189:794): user pid=9001 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158590401.255:795): user pid=9040 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158590401.255:796): login pid=9040 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158590401.255:797): user pid=9040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158590401.255:798): user pid=9040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158590401.279:799): user pid=9040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158590401.279:800): user pid=9040 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158591001.345:801): user pid=9074 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158591001.345:802): login pid=9074 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158591001.349:803): user pid=9074 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158591001.349:804): user pid=9074 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158591001.365:805): user pid=9074 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158591001.365:806): user pid=9074 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158591601.438:807): user pid=9094 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158591601.438:808): login pid=9094 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158591601.438:809): user pid=9094 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158591601.438:810): user pid=9094 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158591601.458:811): user pid=9094 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158591601.458:812): user pid=9094 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158591661.469:813): user pid=9184 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158591661.469:814): login pid=9184 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158591661.469:815): user pid=9184 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158591661.469:816): user pid=9184 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158591661.509:817): user pid=9184 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158591661.513:818): user pid=9184 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158592201.576:819): user pid=9289 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158592201.576:820): login pid=9289 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158592201.580:821): user pid=9289 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158592201.580:822): user pid=9289 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158592201.604:823): user pid=9289 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158592201.604:824): user pid=9289 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158592801.674:825): user pid=9341 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158592801.674:826): login pid=9341 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158592801.674:827): user pid=9341 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158592801.674:828): user pid=9341 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158592801.694:829): user pid=9341 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158592801.694:830): user pid=9341 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158593401.759:831): user pid=9374 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158593401.759:832): login pid=9374 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158593401.759:833): user pid=9374 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158593401.759:834): user pid=9374 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158593401.775:835): user pid=9374 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158593401.775:836): user pid=9374 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158594001.885:837): user pid=9432 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158594001.885:838): login pid=9432 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158594001.889:839): user pid=9432 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158594001.889:840): user pid=9432 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158594001.909:841): user pid=9432 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158594001.909:842): user pid=9432 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158594601.982:843): user pid=9466 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158594601.982:844): login pid=9466 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158594601.982:845): user pid=9466 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158594601.982:846): user pid=9466 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158594601.998:847): user pid=9466 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158594602.002:848): user pid=9466 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158595201.064:849): user pid=9502 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158595201.064:850): login pid=9502 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158595201.068:851): user pid=9502 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158595201.068:852): user pid=9502 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158595201.084:853): user pid=9502 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158595201.084:854): user pid=9502 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158595261.095:855): user pid=9507 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158595261.095:856): login pid=9507 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158595261.095:857): user pid=9507 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158595261.095:858): user pid=9507 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158595261.119:859): user pid=9507 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158595261.119:860): user pid=9507 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_AUTH msg=audit(1158595693.694:861): user pid=9561 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_ACCT msg=audit(1158595693.694:862): user pid=9561 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_START msg=audit(1158595693.734:863): user pid=9561 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_ACQ msg=audit(1158595693.758:864): user pid=9561 uid=500 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_AUTH msg=audit(1158595701.599:865): user pid=9582 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: authentication acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_ACCT msg=audit(1158595701.599:866): user pid=9582 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: accounting acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_START msg=audit(1158595701.627:867): user pid=9582 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: session open acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=CRED_ACQ msg=audit(1158595701.627:868): user pid=9582 uid=0 auid=500 subj=user_u:system_r:unconfined_t:s0 msg='PAM: setcred acct=root : exe="/bin/su" (hostname=?, addr=?, terminal=pts/3 res=success)'
type=USER_ACCT msg=audit(1158595801.182:869): user pid=9617 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158595801.182:870): login pid=9617 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158595801.182:871): user pid=9617 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158595801.182:872): user pid=9617 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158595801.202:873): user pid=9617 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158595801.202:874): user pid=9617 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158596401.275:875): user pid=9645 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158596401.279:876): login pid=9645 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158596401.279:877): user pid=9645 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158596401.279:878): user pid=9645 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158596401.295:879): user pid=9645 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158596401.295:880): user pid=9645 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_ACCT msg=audit(1158597001.361:881): user pid=9692 uid=0 auid=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=LOGIN msg=audit(1158597001.361:882): login pid=9692 uid=0 old auid=4294967295 new auid=0
type=USER_START msg=audit(1158597001.361:883): user pid=9692 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(1158597001.361:884): user pid=9692 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(1158597001.381:885): user pid=9692 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(1158597001.381:886): user pid=9692 uid=0 auid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c255 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'