type=DAEMON_START msg=audit(1274181929.101:980): auditd start, ver=2.0.4 format=raw kernel=2.6.32-25.el6.i686 auid=4294967295 pid=925 subj=system_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1274181929.215:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=USER_START msg=audit(1274181929.498:5): user pid=952 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1274181929.498:6): user pid=952 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1274181929.602:7): user pid=952 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1274181929.602:8): user pid=952 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_AUTH msg=audit(1274181942.788:9): user pid=1123 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=USER_ACCT msg=audit(1274181942.793:10): user pid=1123 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=LOGIN msg=audit(1274181942.794:11): login pid=1123 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_ROLE_CHANGE msg=audit(1274181942.888:12): user pid=1123 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=USER_START msg=audit(1274181942.892:13): user pid=1123 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=CRED_ACQ msg=audit(1274181942.892:14): user pid=1123 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=USER_LOGIN msg=audit(1274181942.893:15): user pid=1123 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=SYSTEM_RUNLEVEL msg=audit(1274182034.336:16): user pid=1174 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=6: exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1274182034.339:17): user pid=1174 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=tty1 res=success'
type=CRED_DISP msg=audit(1274182034.358:18): user pid=1123 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=USER_END msg=audit(1274182034.365:19): user pid=1123 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=DAEMON_END msg=audit(1274182035.133:981): auditd normal halt, sending auid=0 pid=1242 subj=system_u:system_r:initrc_t:s0 res=success
type=DAEMON_START msg=audit(1274182057.972:2903): auditd start, ver=2.0.4 format=raw kernel=2.6.32-25.el6.i686 auid=4294967295 pid=916 subj=system_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1274182058.088:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=USER_START msg=audit(1274182058.203:5): user pid=943 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1274182058.203:6): user pid=943 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1274182058.271:7): user pid=943 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1274182058.271:8): user pid=943 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_AUTH msg=audit(1274182318.871:9): user pid=1094 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=USER_ACCT msg=audit(1274182318.875:10): user pid=1094 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=LOGIN msg=audit(1274182318.876:11): login pid=1094 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_ROLE_CHANGE msg=audit(1274182318.917:12): user pid=1094 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=USER_START msg=audit(1274182318.921:13): user pid=1094 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=CRED_ACQ msg=audit(1274182318.921:14): user pid=1094 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=USER_LOGIN msg=audit(1274182318.922:15): user pid=1094 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=CRED_DISP msg=audit(1274182400.781:16): user pid=1094 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=USER_END msg=audit(1274182400.785:17): user pid=1094 uid=0 auid=0 ses=1 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'
type=USER_LOGIN msg=audit(1274183159.819:18): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="root" exe="/usr/sbin/sshd" hostname=? addr=192.168.0.2 terminal=sshd res=failed'
type=USER_AUTH msg=audit(1274183165.801:19): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1274183165.809:20): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1274183165.815:21): user pid=1662 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1274183165.815:22): login pid=1662 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
type=USER_ROLE_CHANGE msg=audit(1274183165.873:23): user pid=1662 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=failed'
type=USER_ROLE_CHANGE msg=audit(1274183165.873:24): user pid=1662 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
type=USER_START msg=audit(1274183165.880:25): user pid=1662 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1274183165.895:26): user pid=1667 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1274183165.900:27): user pid=1667 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=ADD_GROUP msg=audit(1274183434.805:28): user pid=1711 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=32 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1274183435.118:29): user pid=1711 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=32 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1274183435.119:30): user pid=1711 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=32 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_USER msg=audit(1274183435.191:31): user pid=1715 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=32 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1274183438.677:32): user pid=1724 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding group acct="rpcuser" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
type=ADD_USER msg=audit(1274183438.678:33): user pid=1724 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=29 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1274183440.211:34): user pid=1732 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=65534 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1274183440.506:35): user pid=1732 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=65534 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1274183440.507:36): user pid=1732 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=65534 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_USER msg=audit(1274183440.521:37): user pid=1739 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=65534 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
type=SYSTEM_RUNLEVEL msg=audit(1274183608.984:38): user pid=1846 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=6: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1274183608.987:39): user pid=1846 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1274183609.215:40): user pid=1662 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1274183609.219:41): user pid=1662 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1274183609.881:2904): auditd normal halt, sending auid=0 pid=1923 subj=system_u:system_r:initrc_t:s0 res=success
type=DAEMON_START msg=audit(1274183635.992:3965): auditd start, ver=2.0.4 format=raw kernel=2.6.32-25.el6.i686 auid=4294967295 pid=1002 subj=system_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1274183636.107:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=USER_START msg=audit(1274183636.421:5): user pid=1051 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1274183636.422:6): user pid=1051 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1274183636.490:7): user pid=1051 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1274183636.490:8): user pid=1051 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_LOGIN msg=audit(1274183643.845:9): user pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="root" exe="/usr/sbin/sshd" hostname=? addr=192.168.0.2 terminal=sshd res=failed'
type=USER_AUTH msg=audit(1274183647.193:10): user pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1274183647.200:11): user pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1274183647.206:12): user pid=1298 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1274183647.207:13): login pid=1298 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_ROLE_CHANGE msg=audit(1274183647.267:14): user pid=1298 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=failed'
type=USER_ROLE_CHANGE msg=audit(1274183647.268:15): user pid=1298 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
type=USER_START msg=audit(1274183647.275:16): user pid=1298 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1274183647.290:17): user pid=1302 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1274183647.294:18): user pid=1302 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_END msg=audit(1274183838.221:19): user pid=1298 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1274183838.223:20): user pid=1298 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1274183855.592:21): user pid=1359 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1274183855.597:22): user pid=1359 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1274183855.597:23): login pid=1359 uid=0 old auid=0 new auid=0 old ses=1 new ses=2
type=USER_ROLE_CHANGE msg=audit(1274183855.645:24): user pid=1359 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=failed'
type=USER_ROLE_CHANGE msg=audit(1274183855.645:25): user pid=1359 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
type=USER_START msg=audit(1274183855.651:26): user pid=1359 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1274183855.663:27): user pid=1362 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1274183855.666:28): user pid=1362 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1274184061.580:29): user pid=1380 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274184061.580:30): user pid=1380 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274184061.584:31): login pid=1380 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
type=USER_START msg=audit(1274184061.585:32): user pid=1380 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274184061.683:33): user pid=1380 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274184061.684:34): user pid=1380 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274187661.720:35): user pid=1470 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274187661.722:36): user pid=1470 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274187661.723:37): login pid=1470 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
type=USER_START msg=audit(1274187661.724:38): user pid=1470 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274187661.764:39): user pid=1470 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274187661.765:40): user pid=1470 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274188714.132:41): user pid=1359 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1274188714.134:42): user pid=1359 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1274188738.276:43): user pid=1504 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1274188738.281:44): user pid=1504 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1274188738.281:45): login pid=1504 uid=0 old auid=0 new auid=0 old ses=1 new ses=5
type=USER_ROLE_CHANGE msg=audit(1274188738.325:46): user pid=1504 uid=0 auid=0 ses=5 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=failed'
type=USER_ROLE_CHANGE msg=audit(1274188738.326:47): user pid=1504 uid=0 auid=0 ses=5 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
type=USER_START msg=audit(1274188738.331:48): user pid=1504 uid=0 auid=0 ses=5 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1274188738.344:49): user pid=1507 uid=0 auid=0 ses=5 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1274188738.348:50): user pid=1507 uid=0 auid=0 ses=5 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1274191261.806:51): user pid=1541 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274191261.806:52): user pid=1541 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274191261.807:53): login pid=1541 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
type=USER_START msg=audit(1274191261.809:54): user pid=1541 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274191261.863:55): user pid=1541 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274191261.863:56): user pid=1541 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274194861.893:57): user pid=1603 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274194861.893:58): user pid=1603 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274194861.894:59): login pid=1603 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
type=USER_START msg=audit(1274194861.894:60): user pid=1603 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274194861.933:61): user pid=1603 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274194861.933:62): user pid=1603 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274198461.962:63): user pid=1650 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274198461.963:64): user pid=1650 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274198461.963:65): login pid=1650 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
type=USER_START msg=audit(1274198461.964:66): user pid=1650 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274198462.008:67): user pid=1650 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274198462.008:68): user pid=1650 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274202061.038:69): user pid=1697 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274202061.039:70): user pid=1697 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274202061.039:71): login pid=1697 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=9
type=USER_START msg=audit(1274202061.040:72): user pid=1697 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274202061.084:73): user pid=1697 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274202061.084:74): user pid=1697 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274205661.111:75): user pid=1759 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274205661.112:76): user pid=1759 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274205661.112:77): login pid=1759 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=10
type=USER_START msg=audit(1274205661.113:78): user pid=1759 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274205661.149:79): user pid=1759 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274205661.149:80): user pid=1759 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274209261.178:81): user pid=1805 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274209261.178:82): user pid=1805 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274209261.179:83): login pid=1805 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=11
type=USER_START msg=audit(1274209261.179:84): user pid=1805 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274209261.220:85): user pid=1805 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274209261.220:86): user pid=1805 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274212861.248:87): user pid=1851 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274212861.248:88): user pid=1851 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274212861.249:89): login pid=1851 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=12
type=USER_START msg=audit(1274212861.250:90): user pid=1851 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274212861.288:91): user pid=1851 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274212861.288:92): user pid=1851 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274216461.316:93): user pid=1898 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274216461.316:94): user pid=1898 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274216461.316:95): login pid=1898 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=13
type=USER_START msg=audit(1274216461.317:96): user pid=1898 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274216461.356:97): user pid=1898 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274216461.356:98): user pid=1898 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274220061.383:99): user pid=1961 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274220061.383:100): user pid=1961 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274220061.384:101): login pid=1961 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=14
type=USER_START msg=audit(1274220061.384:102): user pid=1961 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274220061.426:103): user pid=1961 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274220061.426:104): user pid=1961 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274223661.454:105): user pid=2007 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274223661.454:106): user pid=2007 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274223661.454:107): login pid=2007 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=15
type=USER_START msg=audit(1274223661.455:108): user pid=2007 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274223661.492:109): user pid=2007 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274223661.492:110): user pid=2007 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274227261.519:111): user pid=2054 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274227261.520:112): user pid=2054 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274227261.520:113): login pid=2054 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=16
type=USER_START msg=audit(1274227261.521:114): user pid=2054 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274227261.557:115): user pid=2054 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274227261.557:116): user pid=2054 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274230861.584:117): user pid=2116 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274230861.585:118): user pid=2116 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274230861.585:119): login pid=2116 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=17
type=USER_START msg=audit(1274230861.586:120): user pid=2116 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274230861.622:121): user pid=2116 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274230861.622:122): user pid=2116 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274234461.651:123): user pid=2172 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274234461.651:124): user pid=2172 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274234461.652:125): login pid=2172 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=18
type=USER_START msg=audit(1274234461.653:126): user pid=2172 uid=0 auid=0 ses=18 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274234461.690:127): user pid=2172 uid=0 auid=0 ses=18 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274234461.691:128): user pid=2172 uid=0 auid=0 ses=18 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274238061.719:129): user pid=2219 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274238061.720:130): user pid=2219 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274238061.720:131): login pid=2219 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=19
type=USER_START msg=audit(1274238061.721:132): user pid=2219 uid=0 auid=0 ses=19 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274238061.759:133): user pid=2219 uid=0 auid=0 ses=19 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274238061.759:134): user pid=2219 uid=0 auid=0 ses=19 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=SYSTEM_RUNLEVEL msg=audit(1274240491.046:135): user pid=2266 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1274240491.048:136): user pid=2266 uid=0 auid=0 ses=5 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1274240491.268:137): user pid=1504 uid=0 auid=0 ses=5 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1274240491.271:138): user pid=1504 uid=0 auid=0 ses=5 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1274240492.460:3966): auditd normal halt, sending auid=0 pid=2388 subj=system_u:system_r:initrc_t:s0 res=success
type=DAEMON_START msg=audit(1274260309.841:9725): auditd start, ver=2.0.4 format=raw kernel=2.6.32-25.el6.i686 auid=4294967295 pid=996 subj=system_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1274260309.956:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=USER_START msg=audit(1274260310.262:5): user pid=1045 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1274260310.262:6): user pid=1045 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1274260310.332:7): user pid=1045 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1274260310.332:8): user pid=1045 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1274260326.838:9): user pid=1294 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1274260326.845:10): user pid=1294 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1274260326.845:11): login pid=1294 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_ROLE_CHANGE msg=audit(1274260326.900:12): user pid=1294 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=failed'
type=USER_ROLE_CHANGE msg=audit(1274260326.900:13): user pid=1294 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
type=USER_START msg=audit(1274260326.906:14): user pid=1294 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1274260326.920:15): user pid=1297 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1274260326.923:16): user pid=1297 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1274263261.228:17): user pid=1350 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274263261.229:18): user pid=1350 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274263261.232:19): login pid=1350 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
type=USER_START msg=audit(1274263261.234:20): user pid=1350 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274263261.294:21): user pid=1350 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274263261.295:22): user pid=1350 uid=0 auid=0 ses=2 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=SYSTEM_RUNLEVEL msg=audit(1274264358.926:23): user pid=1364 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1274264358.928:24): user pid=1364 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1274264359.148:25): user pid=1294 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1274264359.151:26): user pid=1294 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1274264360.313:9726): auditd normal halt, sending auid=0 pid=1486 subj=system_u:system_r:initrc_t:s0 res=success
type=DAEMON_START msg=audit(1274883293.389:7505): auditd start, ver=2.0.4 format=raw kernel=2.6.32-25.el6.i686 auid=4294967295 pid=1010 subj=system_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1274883293.504:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=USER_START msg=audit(1274883294.547:5): user pid=1059 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1274883294.548:6): user pid=1059 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1274883294.879:7): user pid=1059 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1274883294.879:8): user pid=1059 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1274883429.865:9): user pid=1308 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1274883429.871:10): user pid=1308 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1274883429.871:11): login pid=1308 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_ROLE_CHANGE msg=audit(1274883429.983:12): user pid=1308 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=failed'
type=USER_ROLE_CHANGE msg=audit(1274883429.983:13): user pid=1308 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
type=USER_START msg=audit(1274883429.989:14): user pid=1308 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1274883430.012:15): user pid=1312 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1274883430.016:16): user pid=1312 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1274883591.582:17): user pid=1360 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1274883591.588:18): user pid=1360 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1274883591.589:19): login pid=1360 uid=0 old auid=0 new auid=0 old ses=1 new ses=2
type=USER_ROLE_CHANGE msg=audit(1274883591.743:20): user pid=1360 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=failed'
type=USER_ROLE_CHANGE msg=audit(1274883591.743:21): user pid=1360 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
type=USER_START msg=audit(1274883591.750:22): user pid=1360 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1274883591.764:23): user pid=1363 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/1 res=success'
type=CRED_REFR msg=audit(1274883592.066:24): user pid=1363 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=MAC_POLICY_LOAD msg=audit(1274883750.898:25): policy loaded auid=0 ses=1
type=SYSCALL msg=audit(1274883750.898:25): arch=40000003 syscall=4 success=yes exit=5673548 a0=4 a1=b72e0000 a2=56924c a3=4 items=0 ppid=1422 pid=1423 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
type=USER_ACCT msg=audit(1274886061.660:26): user pid=8677 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274886061.661:27): user pid=8677 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274886061.664:28): login pid=8677 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
type=USER_START msg=audit(1274886061.667:29): user pid=8677 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274886061.743:30): user pid=8677 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274886061.743:31): user pid=8677 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=ANOM_ABEND msg=audit(1274888221.841:32): auid=0 uid=0 gid=0 ses=1 subj=unconfined_u:system_r:syslogd_t:s0 pid=8735 comm=72733A6D61696E20513A526567 sig=11
type=USER_ACCT msg=audit(1274889661.777:33): user pid=8767 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274889661.777:34): user pid=8767 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274889661.778:35): login pid=8767 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
type=USER_START msg=audit(1274889661.779:36): user pid=8767 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274889661.818:37): user pid=8767 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274889661.818:38): user pid=8767 uid=0 auid=0 ses=4 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274893261.845:39): user pid=8810 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274893261.846:40): user pid=8810 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274893261.846:41): login pid=8810 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=5
type=USER_START msg=audit(1274893261.847:42): user pid=8810 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274893261.884:43): user pid=8810 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274893261.884:44): user pid=8810 uid=0 auid=0 ses=5 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274896861.912:45): user pid=8854 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274896861.912:46): user pid=8854 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274896861.913:47): login pid=8854 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=6
type=USER_START msg=audit(1274896861.913:48): user pid=8854 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274896861.950:49): user pid=8854 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274896861.951:50): user pid=8854 uid=0 auid=0 ses=6 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274900461.978:51): user pid=8897 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274900461.979:52): user pid=8897 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274900461.979:53): login pid=8897 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=7
type=USER_START msg=audit(1274900461.980:54): user pid=8897 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274900462.017:55): user pid=8897 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274900462.017:56): user pid=8897 uid=0 auid=0 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274904061.045:57): user pid=8956 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274904061.045:58): user pid=8956 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274904061.045:59): login pid=8956 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=8
type=USER_START msg=audit(1274904061.046:60): user pid=8956 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274904061.082:61): user pid=8956 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274904061.083:62): user pid=8956 uid=0 auid=0 ses=8 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274907661.110:63): user pid=9000 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274907661.111:64): user pid=9000 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274907661.111:65): login pid=9000 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=9
type=USER_START msg=audit(1274907661.112:66): user pid=9000 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274907661.148:67): user pid=9000 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274907661.148:68): user pid=9000 uid=0 auid=0 ses=9 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274911261.176:69): user pid=9043 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274911261.177:70): user pid=9043 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274911261.177:71): login pid=9043 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=10
type=USER_START msg=audit(1274911261.178:72): user pid=9043 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274911261.215:73): user pid=9043 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274911261.215:74): user pid=9043 uid=0 auid=0 ses=10 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274914861.243:75): user pid=9087 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274914861.243:76): user pid=9087 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274914861.244:77): login pid=9087 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=11
type=USER_START msg=audit(1274914861.244:78): user pid=9087 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274914861.281:79): user pid=9087 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274914861.282:80): user pid=9087 uid=0 auid=0 ses=11 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274918461.309:81): user pid=9130 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274918461.310:82): user pid=9130 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274918461.310:83): login pid=9130 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=12
type=USER_START msg=audit(1274918461.311:84): user pid=9130 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274918461.348:85): user pid=9130 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274918461.348:86): user pid=9130 uid=0 auid=0 ses=12 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274922061.375:87): user pid=9189 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274922061.375:88): user pid=9189 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274922061.375:89): login pid=9189 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=13
type=USER_START msg=audit(1274922061.376:90): user pid=9189 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274922061.412:91): user pid=9189 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274922061.413:92): user pid=9189 uid=0 auid=0 ses=13 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274925661.440:93): user pid=9242 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274925661.440:94): user pid=9242 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274925661.441:95): login pid=9242 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=14
type=USER_START msg=audit(1274925661.441:96): user pid=9242 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274925661.478:97): user pid=9242 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274925661.478:98): user pid=9242 uid=0 auid=0 ses=14 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274929261.505:99): user pid=9285 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274929261.505:100): user pid=9285 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274929261.506:101): login pid=9285 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=15
type=USER_START msg=audit(1274929261.507:102): user pid=9285 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274929261.544:103): user pid=9285 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274929261.544:104): user pid=9285 uid=0 auid=0 ses=15 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274932861.571:105): user pid=9344 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274932861.571:106): user pid=9344 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274932861.572:107): login pid=9344 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=16
type=USER_START msg=audit(1274932861.572:108): user pid=9344 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274932861.608:109): user pid=9344 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274932861.609:110): user pid=9344 uid=0 auid=0 ses=16 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274936461.637:111): user pid=9387 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274936461.637:112): user pid=9387 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274936461.637:113): login pid=9387 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=17
type=USER_START msg=audit(1274936461.638:114): user pid=9387 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274936461.675:115): user pid=9387 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274936461.675:116): user pid=9387 uid=0 auid=0 ses=17 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274940061.704:117): user pid=9431 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274940061.704:118): user pid=9431 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274940061.705:119): login pid=9431 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=18
type=USER_START msg=audit(1274940061.705:120): user pid=9431 uid=0 auid=0 ses=18 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274940061.742:121): user pid=9431 uid=0 auid=0 ses=18 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274940061.743:122): user pid=9431 uid=0 auid=0 ses=18 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274943661.771:123): user pid=9490 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274943661.772:124): user pid=9490 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274943661.772:125): login pid=9490 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=19
type=USER_START msg=audit(1274943661.773:126): user pid=9490 uid=0 auid=0 ses=19 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274943661.809:127): user pid=9490 uid=0 auid=0 ses=19 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274943661.809:128): user pid=9490 uid=0 auid=0 ses=19 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274947261.838:129): user pid=9533 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274947261.839:130): user pid=9533 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274947261.839:131): login pid=9533 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=20
type=USER_START msg=audit(1274947261.840:132): user pid=9533 uid=0 auid=0 ses=20 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274947261.877:133): user pid=9533 uid=0 auid=0 ses=20 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274947261.878:134): user pid=9533 uid=0 auid=0 ses=20 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274950861.906:135): user pid=9577 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274950861.907:136): user pid=9577 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274950861.907:137): login pid=9577 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=21
type=USER_START msg=audit(1274950861.908:138): user pid=9577 uid=0 auid=0 ses=21 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274950861.944:139): user pid=9577 uid=0 auid=0 ses=21 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274950861.945:140): user pid=9577 uid=0 auid=0 ses=21 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1274954461.973:141): user pid=9635 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1274954461.973:142): user pid=9635 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1274954461.974:143): login pid=9635 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=22
type=USER_START msg=audit(1274954461.974:144): user pid=9635 uid=0 auid=0 ses=22 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1274954462.010:145): user pid=9635 uid=0 auid=0 ses=22 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1274954462.010:146): user pid=9635 uid=0 auid=0 ses=22 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=SYSTEM_RUNLEVEL msg=audit(1274955426.404:147): user pid=9650 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1274955426.406:148): user pid=9650 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1274955426.769:149): user pid=1308 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_END msg=audit(1274955426.771:150): user pid=1360 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1274955426.771:151): user pid=1308 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1274955426.774:152): user pid=1360 uid=0 auid=0 ses=2 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1274955428.001:7506): auditd normal halt, sending auid=0 pid=9785 subj=system_u:system_r:initrc_t:s0 res=success
type=DAEMON_START msg=audit(1275538720.375:2401): auditd start, ver=2.0.4 format=raw kernel=2.6.32-28.el6.i686 auid=4294967295 pid=987 subj=system_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1275538720.492:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=USER_START msg=audit(1275538721.237:5): user pid=1036 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1275538721.238:6): user pid=1036 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1275538721.355:7): user pid=1036 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1275538721.355:8): user pid=1036 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1275538759.956:9): user pid=1291 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1275538759.961:10): user pid=1291 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1275538759.962:11): login pid=1291 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_ROLE_CHANGE msg=audit(1275538760.034:12): user pid=1291 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=failed'
type=USER_ROLE_CHANGE msg=audit(1275538760.035:13): user pid=1291 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
type=USER_START msg=audit(1275538760.041:14): user pid=1291 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1275538760.068:15): user pid=1294 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1275538760.072:16): user pid=1294 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1275538891.679:17): user pid=1311 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="fabbione" exe="/usr/sbin/sshd" hostname=? addr=192.168.0.2 terminal=sshd res=failed'
type=USER_ERR msg=audit(1275538917.945:18): user pid=1311 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:bad_ident acct="?" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=failed'
type=USER_ACCT msg=audit(1275538927.370:19): user pid=1316 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1275538927.375:20): user pid=1316 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1275538927.375:21): login pid=1316 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
type=USER_ROLE_CHANGE msg=audit(1275538927.416:22): user pid=1316 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=failed'
type=USER_ROLE_CHANGE msg=audit(1275538927.416:23): user pid=1316 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
type=USER_START msg=audit(1275538927.421:24): user pid=1316 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_REFR msg=audit(1275538927.428:25): user pid=1319 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_END msg=audit(1275538927.473:26): user pid=1316 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1275538927.475:27): user pid=1316 uid=0 auid=0 ses=2 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=MAC_POLICY_LOAD msg=audit(1275539200.417:28): policy loaded auid=0 ses=1
type=SYSCALL msg=audit(1275539200.417:28): arch=40000003 syscall=4 success=yes exit=5656893 a0=4 a1=b72c3000 a2=56513d a3=4 items=0 ppid=1395 pid=1396 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="load_policy" exe="/sbin/load_policy" subj=unconfined_u:system_r:load_policy_t:s0-s0:c0.c1023 key=(null)
type=ADD_USER msg=audit(1275539232.965:29): user pid=1472 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_USER msg=audit(1275539232.965:30): user pid=1472 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_USER msg=audit(1275539238.170:31): user pid=1490 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="postfix" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_USER msg=audit(1275539238.170:32): user pid=1490 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user acct="postfix" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=USER_START msg=audit(1275539323.255:33): user pid=2121 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
type=CRED_ACQ msg=audit(1275539323.255:34): user pid=2121 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
type=CRED_DISP msg=audit(1275539323.296:35): user pid=2121 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
type=USER_END msg=audit(1275539323.296:36): user pid=2121 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1275539423.281:37): user pid=7316 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=81 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1275539423.548:38): user pid=7316 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=81 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1275539423.549:39): user pid=7316 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=81 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_USER msg=audit(1275539423.666:40): user pid=7320 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=81 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1275539493.899:41): user pid=7377 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/group id=140 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1275539494.133:42): user pid=7377 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op=adding group to /etc/gshadow id=140 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1275539494.134:43): user pid=7377 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:groupadd_t:s0-s0:c0.c1023 msg='op= id=140 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_USER msg=audit(1275539494.252:44): user pid=7381 uid=0 auid=0 ses=1 subj=unconfined_u:system_r:useradd_t:s0-s0:c0.c1023 msg='op=adding user id=140 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
type=USER_ACCT msg=audit(1275541261.179:45): user pid=7423 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1275541261.180:46): user pid=7423 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1275541261.183:47): login pid=7423 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
type=USER_START msg=audit(1275541261.184:48): user pid=7423 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1275541261.252:49): user pid=7423 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1275541261.252:50): user pid=7423 uid=0 auid=0 ses=3 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=ANOM_ABEND msg=audit(1275543301.532:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:syslogd_t:s0 pid=7483 comm=72733A6D61696E20513A526567 sig=11
type=SYSTEM_RUNLEVEL msg=audit(1275543427.831:52): user pid=7489 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1275543427.834:53): user pid=7489 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1275543428.199:54): user pid=1291 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe=2F7573722F7362696E2F73736864202864656C6574656429 hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1275543428.202:55): user pid=1291 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe=2F7573722F7362696E2F73736864202864656C6574656429 hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1275543429.489:2402): auditd normal halt, sending auid=0 pid=7640 subj=system_u:system_r:initrc_t:s0 res=success
type=DAEMON_START msg=audit(1275543893.815:536): auditd start, ver=2.0.4 format=raw kernel=2.6.32-31.el6.i686 auid=4294967295 pid=995 subj=system_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1275543893.929:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=USER_START msg=audit(1275543894.251:5): user pid=1048 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1275543894.251:6): user pid=1048 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1275543894.295:7): user pid=1048 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1275543894.295:8): user pid=1048 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1275543920.274:9): user pid=1318 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1275543920.279:10): user pid=1318 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1275543920.280:11): login pid=1318 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_ROLE_CHANGE msg=audit(1275543920.336:12): user pid=1318 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=failed'
type=USER_ROLE_CHANGE msg=audit(1275543920.336:13): user pid=1318 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
type=USER_START msg=audit(1275543920.342:14): user pid=1318 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1275543920.378:15): user pid=1321 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1275543920.488:16): user pid=1321 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1275543958.322:17): user pid=1337 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1275543958.322:18): user pid=1337 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1275543958.693:19): user pid=1318 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1275543958.695:20): user pid=1318 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1275543959.409:537): auditd normal halt, sending auid=0 pid=1437 subj=system_u:system_r:initrc_t:s0 res=success
type=DAEMON_START msg=audit(1275546320.839:6789): auditd start, ver=2.0.4 format=raw kernel=2.6.32-31.el6.i686 auid=4294967295 pid=1012 subj=system_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1275546320.954:4): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=USER_START msg=audit(1275546321.320:5): user pid=1065 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1275546321.320:6): user pid=1065 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1275546321.374:7): user pid=1065 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1275546321.375:8): user pid=1065 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:initrc_t:s0 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1275546345.498:9): user pid=1337 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1275546345.504:10): user pid=1337 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1275546345.504:11): login pid=1337 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_ROLE_CHANGE msg=audit(1275546345.556:12): user pid=1337 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=?: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=failed'
type=USER_ROLE_CHANGE msg=audit(1275546345.557:13): user pid=1337 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='pam: default-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 selected-context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023: exe="/usr/sbin/sshd" hostname=? addr=? terminal=? res=success'
type=USER_START msg=audit(1275546345.563:14): user pid=1337 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1275546345.575:15): user pid=1340 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1275546345.578:16): user pid=1340 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1275546418.161:17): user pid=1448 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1275546418.164:18): user pid=1448 uid=0 auid=0 ses=1 subj=unconfined_u:unconfined_r:shutdown_t:s0-s0:c0.c1023 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1275546418.539:19): user pid=1337 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1275546418.542:20): user pid=1337 uid=0 auid=0 ses=1 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1275546419.696:6790): auditd normal halt, sending auid=0 pid=1550 subj=system_u:system_r:initrc_t:s0 res=success
type=DAEMON_START msg=audit(1278312807.986:6401): auditd start, ver=2.0.4 format=raw kernel=2.6.32-31.el6.i686 auid=4294967295 pid=957 res=success
type=CONFIG_CHANGE msg=audit(1278312808.120:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1278312808.936:4): user pid=1011 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1278312808.936:5): user pid=1011 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1278312809.101:6): user pid=1011 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1278312809.101:7): user pid=1011 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1278312846.169:8): user pid=1282 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1278312846.174:9): user pid=1282 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1278312846.174:10): login pid=1282 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1278312846.177:11): user pid=1282 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1278312846.199:12): user pid=1284 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1278312846.202:13): user pid=1284 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1278313265.486:14): user pid=1379 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1278313265.487:15): user pid=1379 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1278313265.487:16): login pid=1379 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
type=USER_START msg=audit(1278313265.590:17): user pid=1379 uid=0 auid=0 ses=2 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1278313266.743:18): user pid=1379 uid=0 auid=0 ses=2 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1278313266.744:19): user pid=1379 uid=0 auid=0 ses=2 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=ADD_USER msg=audit(1278313489.134:20): user pid=1474 uid=0 auid=0 ses=1 msg='op=adding user acct="ricci" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_USER msg=audit(1278313489.134:21): user pid=1474 uid=0 auid=0 ses=1 msg='op=adding user acct="ricci" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_USER msg=audit(1278313564.389:22): user pid=1505 uid=0 auid=0 ses=1 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_USER msg=audit(1278313564.389:23): user pid=1505 uid=0 auid=0 ses=1 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=SYSTEM_RUNLEVEL msg=audit(1278314892.902:24): user pid=7132 uid=0 auid=0 ses=1 msg='old-level=3 new-level=6: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1278314892.902:25): user pid=7132 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1278314893.365:26): user pid=1282 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe=2F7573722F7362696E2F73736864202864656C6574656429 hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1278314893.367:27): user pid=1282 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe=2F7573722F7362696E2F73736864202864656C6574656429 hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1278314894.572:6402): auditd normal halt, sending auid=0 pid=7257 subj= res=success
type=DAEMON_START msg=audit(1278314930.449:2860): auditd start, ver=2.0.4 format=raw kernel=2.6.32-42.el6.i686 auid=4294967295 pid=1016 res=success
type=CONFIG_CHANGE msg=audit(1278314930.559:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1278314931.065:4): user pid=1069 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1278314931.065:5): user pid=1069 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1278314931.086:6): user pid=1069 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1278314931.087:7): user pid=1069 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1278315101.535:8): user pid=1341 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1278315101.540:9): user pid=1341 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1278315101.541:10): login pid=1341 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1278315101.543:11): user pid=1341 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1278315101.553:12): user pid=1344 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1278315101.556:13): user pid=1344 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1278315104.657:14): user pid=1355 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1278315104.657:15): user pid=1355 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1278315104.994:16): user pid=1341 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1278315104.996:17): user pid=1341 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1278315105.693:2861): auditd normal halt, sending auid=0 pid=1465 subj= res=success
type=DAEMON_START msg=audit(1278418569.848:2445): auditd start, ver=2.0.4 format=raw kernel=2.6.32-42.el6.i686 auid=4294967295 pid=1014 res=success
type=CONFIG_CHANGE msg=audit(1278418569.961:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1278418570.792:4): user pid=1067 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1278418570.792:5): user pid=1067 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1278418570.881:6): user pid=1067 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1278418570.881:7): user pid=1067 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1278418591.232:8): user pid=1339 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1278418591.238:9): user pid=1339 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1278418591.238:10): login pid=1339 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1278418591.241:11): user pid=1339 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1278418591.260:12): user pid=1341 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1278418591.263:13): user pid=1341 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1278418640.449:14): user pid=1370 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=? res=success'
type=SYSTEM_SHUTDOWN msg=audit(1278418640.449:15): user pid=1370 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=? res=success'
type=USER_END msg=audit(1278418641.265:16): user pid=1339 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1278418641.267:17): user pid=1339 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1278418642.075:2446): auditd normal halt, sending auid=0 pid=1487 subj= res=success
type=DAEMON_START msg=audit(1278419941.474:4793): auditd start, ver=2.0.4 format=raw kernel=2.6.32-42.el6.i686 auid=4294967295 pid=1019 res=success
type=CONFIG_CHANGE msg=audit(1278419941.586:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1278419941.888:4): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1278419941.888:5): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1278419941.907:6): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1278419941.907:7): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1278419975.260:8): user pid=1353 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1278419975.266:9): user pid=1353 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1278419975.266:10): login pid=1353 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1278419975.268:11): user pid=1353 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1278419975.278:12): user pid=1355 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1278419975.281:13): user pid=1355 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1278419990.300:14): user pid=1367 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1278419990.300:15): user pid=1367 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1278419990.636:16): user pid=1353 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1278419990.638:17): user pid=1353 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1278419991.453:4794): auditd normal halt, sending auid=0 pid=1484 subj= res=success
type=DAEMON_START msg=audit(1278491349.741:9937): auditd start, ver=2.0.4 format=raw kernel=2.6.32-42.el6.i686 auid=4294967295 pid=1019 res=success
type=CONFIG_CHANGE msg=audit(1278491349.854:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1278491350.476:4): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1278491350.476:5): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1278491350.532:6): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1278491350.532:7): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1278491363.987:8): user pid=1353 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1278491363.992:9): user pid=1353 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1278491363.992:10): login pid=1353 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1278491363.995:11): user pid=1353 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1278491364.018:12): user pid=1355 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1278491364.020:13): user pid=1355 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1278491604.669:14): user pid=6624 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1278491604.669:15): user pid=6624 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1278491605.428:16): user pid=1353 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1278491605.430:17): user pid=1353 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1278491606.245:9938): auditd normal halt, sending auid=0 pid=6741 subj= res=success
type=DAEMON_START msg=audit(1278592943.508:8473): auditd start, ver=2.0.4 format=raw kernel=2.6.32-43.el6.i686 auid=4294967295 pid=1042 res=success
type=CONFIG_CHANGE msg=audit(1278592943.618:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1278592944.028:4): user pid=1095 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1278592944.028:5): user pid=1095 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1278592944.046:6): user pid=1095 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1278592944.046:7): user pid=1095 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1278592975.852:8): user pid=1376 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1278592975.857:9): user pid=1376 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1278592975.857:10): login pid=1376 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1278592975.859:11): user pid=1376 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1278592975.869:12): user pid=1378 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1278592975.872:13): user pid=1378 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1278593120.301:14): user pid=1390 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1278593120.302:15): user pid=1390 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1278593120.624:16): user pid=1376 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1278593120.626:17): user pid=1376 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1278593121.455:8474): auditd normal halt, sending auid=0 pid=1508 subj= res=success
type=DAEMON_START msg=audit(1278667628.528:9246): auditd start, ver=2.0.4 format=raw kernel=2.6.32-43.el6.i686 auid=4294967295 pid=1019 res=success
type=CONFIG_CHANGE msg=audit(1278667628.639:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1278667628.919:4): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1278667628.919:5): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1278667628.937:6): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1278667628.937:7): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1278667635.071:8): user pid=1314 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1278667635.076:9): user pid=1314 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1278667635.077:10): login pid=1314 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1278667635.228:11): user pid=1314 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1278667635.238:12): user pid=1355 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1278667635.241:13): user pid=1355 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1278669661.872:14): user pid=6635 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1278669661.873:15): user pid=6635 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1278669661.873:16): login pid=6635 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
type=USER_START msg=audit(1278669661.874:17): user pid=6635 uid=0 auid=0 ses=2 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1278669661.921:18): user pid=6635 uid=0 auid=0 ses=2 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1278669661.922:19): user pid=6635 uid=0 auid=0 ses=2 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=SYSTEM_RUNLEVEL msg=audit(1278670222.528:20): user pid=6648 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1278670222.528:21): user pid=6648 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1278670222.841:22): user pid=1314 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1278670222.843:23): user pid=1314 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1278670223.861:9247): auditd normal halt, sending auid=0 pid=6766 subj= res=success
type=DAEMON_START msg=audit(1278923698.807:5506): auditd start, ver=2.0.4 format=raw kernel=2.6.32-44.el6.i686 auid=4294967295 pid=1018 res=success
type=CONFIG_CHANGE msg=audit(1278923698.918:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1278923700.117:4): user pid=1071 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1278923700.117:5): user pid=1071 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1278923700.199:6): user pid=1071 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1278923700.199:7): user pid=1071 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1278923732.854:8): user pid=1352 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1278923732.895:9): user pid=1352 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1278923732.895:10): login pid=1352 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1278923732.898:11): user pid=1352 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1278923732.932:12): user pid=1354 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1278923732.935:13): user pid=1354 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1278923761.529:14): user pid=1367 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1278923761.529:15): user pid=1367 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1278923762.255:16): user pid=1352 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1278923762.257:17): user pid=1352 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1278923763.081:5507): auditd normal halt, sending auid=0 pid=1484 subj= res=success
type=DAEMON_START msg=audit(1279090335.643:2435): auditd start, ver=2.0.4 format=raw kernel=2.6.32-44.el6.i686 auid=4294967295 pid=1019 res=success
type=CONFIG_CHANGE msg=audit(1279090335.889:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1279090336.620:4): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1279090336.620:5): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1279090336.664:6): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1279090336.664:7): user pid=1072 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1279090397.736:8): user pid=1353 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1279090397.741:9): user pid=1353 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1279090397.741:10): login pid=1353 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1279090397.743:11): user pid=1353 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1279090397.760:12): user pid=1355 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1279090397.763:13): user pid=1355 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1279090422.491:14): user pid=1367 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1279090422.491:15): user pid=1367 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1279090423.178:16): user pid=1353 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1279090423.180:17): user pid=1353 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1279090424.013:2436): auditd normal halt, sending auid=0 pid=1484 subj= res=success
type=DAEMON_START msg=audit(1279190226.778:6749): auditd start, ver=2.0.4 format=raw kernel=2.6.32-44.el6.i686 auid=4294967295 pid=1012 res=success
type=CONFIG_CHANGE msg=audit(1279190226.888:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1279190227.558:4): user pid=1065 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1279190227.558:5): user pid=1065 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1279190227.616:6): user pid=1065 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1279190227.616:7): user pid=1065 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1279190298.085:8): user pid=1347 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1279190298.090:9): user pid=1347 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1279190298.090:10): login pid=1347 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1279190298.093:11): user pid=1347 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1279190298.121:12): user pid=1350 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1279190298.124:13): user pid=1350 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1279190321.169:14): user pid=1362 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1279190321.169:15): user pid=1362 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1279190322.063:16): user pid=1347 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1279190322.065:17): user pid=1347 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1279190322.895:6750): auditd normal halt, sending auid=0 pid=1479 subj= res=success
type=DAEMON_START msg=audit(1279267320.618:5564): auditd start, ver=2.0.4 format=raw kernel=2.6.32-44.el6.i686 auid=4294967295 pid=1006 res=success
type=CONFIG_CHANGE msg=audit(1279267320.731:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1279267321.568:4): user pid=1059 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1279267321.568:5): user pid=1059 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1279267321.635:6): user pid=1059 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1279267321.635:7): user pid=1059 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1279267543.877:8): user pid=1341 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1279267543.882:9): user pid=1341 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1279267543.882:10): login pid=1341 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1279267543.885:11): user pid=1341 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1279267543.912:12): user pid=1344 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1279267543.914:13): user pid=1344 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1279267681.969:14): user pid=6604 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1279267681.970:15): user pid=6604 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1279267682.616:16): user pid=1341 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1279267682.618:17): user pid=1341 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1279267683.436:5565): auditd normal halt, sending auid=0 pid=6722 subj= res=success
type=DAEMON_START msg=audit(1279520366.269:6549): auditd start, ver=2.0.4 format=raw kernel=2.6.32-44.1.el6.i686 auid=4294967295 pid=1017 res=success
type=CONFIG_CHANGE msg=audit(1279520366.380:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1279520367.253:4): user pid=1070 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1279520367.253:5): user pid=1070 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1279520367.367:6): user pid=1070 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1279520367.367:7): user pid=1070 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1279521930.603:8): user pid=1367 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1279521930.608:9): user pid=1367 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1279521930.608:10): login pid=1367 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1279521930.611:11): user pid=1367 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1279521930.633:12): user pid=1370 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1279521930.636:13): user pid=1370 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1279521960.587:14): user pid=1382 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1279521960.588:15): user pid=1382 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1279521961.680:16): user pid=1367 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1279521961.682:17): user pid=1367 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1279521962.511:6550): auditd normal halt, sending auid=0 pid=1499 subj= res=success
type=DAEMON_START msg=audit(1279863424.174:453): auditd start, ver=2.0.4 format=raw kernel=2.6.32-44.1.el6.i686 auid=4294967295 pid=1013 res=success
type=CONFIG_CHANGE msg=audit(1279863424.284:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1279863424.948:4): user pid=1066 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1279863424.949:5): user pid=1066 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1279863424.990:6): user pid=1066 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1279863424.990:7): user pid=1066 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1279863508.692:8): user pid=1348 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1279863508.733:9): user pid=1348 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1279863508.734:10): login pid=1348 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1279863508.736:11): user pid=1348 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1279863508.771:12): user pid=1351 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1279863508.774:13): user pid=1351 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=ADD_USER msg=audit(1279863886.469:14): user pid=1394 uid=0 auid=0 ses=1 msg='op=adding user acct="dbus" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_USER msg=audit(1279863886.469:15): user pid=1394 uid=0 auid=0 ses=1 msg='op=adding user acct="dbus" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_USER msg=audit(1279863948.010:16): user pid=1452 uid=0 auid=0 ses=1 msg='op=adding user acct="ricci" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_USER msg=audit(1279863948.010:17): user pid=1452 uid=0 auid=0 ses=1 msg='op=adding user acct="ricci" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_GROUP msg=audit(1279864183.497:18): user pid=6922 uid=0 auid=0 ses=1 msg='op=adding group to /etc/group id=495 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1279864183.698:19): user pid=6922 uid=0 auid=0 ses=1 msg='op=adding group to /etc/gshadow id=495 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_GROUP msg=audit(1279864183.698:20): user pid=6922 uid=0 auid=0 ses=1 msg='op= id=495 exe="/usr/sbin/groupadd" hostname=? addr=? terminal=? res=success'
type=ADD_USER msg=audit(1279864183.817:21): user pid=6927 uid=0 auid=0 ses=1 msg='op=adding user id=498 exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=success'
type=SYSTEM_RUNLEVEL msg=audit(1279864201.987:22): user pid=6934 uid=0 auid=0 ses=1 msg='old-level=3 new-level=6: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1279864201.987:23): user pid=6934 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1279864202.526:24): user pid=1348 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe=2F7573722F7362696E2F73736864202864656C6574656429 hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1279864202.537:25): user pid=1348 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe=2F7573722F7362696E2F73736864202864656C6574656429 hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1279864203.376:454): auditd normal halt, sending auid=0 pid=7057 subj= res=success
type=DAEMON_START msg=audit(1279864231.475:5324): auditd start, ver=2.0.4 format=raw kernel=2.6.32-52.el6.i686 auid=4294967295 pid=1015 res=success
type=CONFIG_CHANGE msg=audit(1279864231.587:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1279864231.903:4): user pid=1075 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1279864231.903:5): user pid=1075 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1279864231.924:6): user pid=1075 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1279864231.924:7): user pid=1075 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1279864453.992:8): user pid=1356 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1279864453.997:9): user pid=1356 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1279864453.997:10): login pid=1356 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1279864454.000:11): user pid=1356 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1279864454.010:12): user pid=1359 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1279864454.013:13): user pid=1359 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1279864862.180:14): user pid=1372 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1279864862.181:15): user pid=1372 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1279864862.181:16): login pid=1372 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
type=USER_START msg=audit(1279864862.182:17): user pid=1372 uid=0 auid=0 ses=2 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1279864862.279:18): user pid=1372 uid=0 auid=0 ses=2 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1279864862.279:19): user pid=1372 uid=0 auid=0 ses=2 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=SYSTEM_RUNLEVEL msg=audit(1279865045.796:20): user pid=1389 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1279865045.796:21): user pid=1389 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1279865046.211:22): user pid=1356 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1279865046.213:23): user pid=1356 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1279865047.059:5325): auditd normal halt, sending auid=0 pid=1511 subj= res=success
type=DAEMON_START msg=audit(1280129066.685:8830): auditd start, ver=2.0.4 format=raw kernel=2.6.32-52.el6.i686 auid=4294967295 pid=1019 res=success
type=CONFIG_CHANGE msg=audit(1280129066.797:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1280129067.713:4): user pid=1079 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1280129067.713:5): user pid=1079 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1280129067.771:6): user pid=1079 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1280129067.771:7): user pid=1079 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1280129133.868:8): user pid=1360 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1280129133.873:9): user pid=1360 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1280129133.873:10): login pid=1360 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1280129133.876:11): user pid=1360 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1280129133.912:12): user pid=1362 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1280129133.991:13): user pid=1362 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1280129475.388:14): user pid=1391 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1280129475.388:15): user pid=1391 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1280129476.285:16): user pid=1360 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1280129476.287:17): user pid=1360 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1280129477.121:8831): auditd normal halt, sending auid=0 pid=1513 subj= res=success
type=DAEMON_START msg=audit(1280236719.469:7790): auditd start, ver=2.0.4 format=raw kernel=2.6.32-52.el6.i686 auid=4294967295 pid=1018 res=success
type=CONFIG_CHANGE msg=audit(1280236719.579:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1280236719.902:4): user pid=1078 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1280236719.903:5): user pid=1078 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1280236719.921:6): user pid=1078 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1280236719.921:7): user pid=1078 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=SYSTEM_RUNLEVEL msg=audit(1280236750.209:8): user pid=1363 uid=0 auid=4294967295 ses=4294967295 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=? res=success'
type=SYSTEM_SHUTDOWN msg=audit(1280236750.209:9): user pid=1363 uid=0 auid=4294967295 ses=4294967295 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=? res=success'
type=DAEMON_END msg=audit(1280236751.390:7791): auditd normal halt, sending auid=0 pid=1484 subj= res=success
type=DAEMON_START msg=audit(1280824932.826:2027): auditd start, ver=2.0.4 format=raw kernel=2.6.32-52.el6.i686 auid=4294967295 pid=1022 res=success
type=CONFIG_CHANGE msg=audit(1280824932.937:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1280824933.919:4): user pid=1082 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1280824933.920:5): user pid=1082 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1280824934.052:6): user pid=1082 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1280824934.052:7): user pid=1082 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1280824966.602:8): user pid=1363 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1280824966.607:9): user pid=1363 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1280824966.608:10): login pid=1363 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1280824966.610:11): user pid=1363 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1280824966.629:12): user pid=1365 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1280824966.632:13): user pid=1365 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=ADD_USER msg=audit(1280825340.338:14): user pid=1453 uid=0 auid=0 ses=1 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_USER msg=audit(1280825340.338:15): user pid=1453 uid=0 auid=0 ses=1 msg='op=adding user acct="rpcuser" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=USER_ACCT msg=audit(1280825340.655:16): user pid=1458 uid=0 auid=0 ses=1 msg='op=changing /etc/group; group nfsnobody/65534 acct="nfsnobody" exe="/usr/sbin/groupmod" hostname=? addr=? terminal=? res=success'
type=USER_ACCT msg=audit(1280825340.656:17): user pid=1458 uid=0 auid=0 ses=1 msg='op=modifying group acct="nfsnobody" exe="/usr/sbin/groupmod" hostname=? addr=? terminal=? res=success'
type=ADD_USER msg=audit(1280825360.407:18): user pid=1483 uid=0 auid=0 ses=1 msg='op=adding user acct="ricci" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=ADD_USER msg=audit(1280825360.407:19): user pid=1483 uid=0 auid=0 ses=1 msg='op=adding user acct="ricci" exe="/usr/sbin/useradd" hostname=? addr=? terminal=? res=failed'
type=USER_START msg=audit(1280825567.757:20): user pid=1832 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
type=CRED_ACQ msg=audit(1280825567.757:21): user pid=1832 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
type=CRED_DISP msg=audit(1280825567.766:22): user pid=1832 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
type=USER_END msg=audit(1280825567.766:23): user pid=1832 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=? res=success'
type=SYSTEM_RUNLEVEL msg=audit(1280825667.195:24): user pid=7103 uid=0 auid=0 ses=1 msg='old-level=3 new-level=6: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1280825667.196:25): user pid=7103 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1280825667.518:26): user pid=1363 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1280825667.521:27): user pid=1363 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1280825671.125:2028): auditd normal halt, sending auid=0 pid=7236 subj= res=success
type=DAEMON_START msg=audit(1280825708.564:6970): auditd start, ver=2.0.4 format=raw kernel=2.6.32-54.el6.i686 auid=4294967295 pid=1021 res=success
type=CONFIG_CHANGE msg=audit(1280825708.674:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1280825709.284:4): user pid=1082 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1280825709.285:5): user pid=1082 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1280825709.296:6): user pid=1082 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1280825709.296:7): user pid=1082 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1280826061.078:8): user pid=1363 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1280826061.079:9): user pid=1363 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1280826061.079:10): login pid=1363 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1280826061.080:11): user pid=1363 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1280826061.149:12): user pid=1363 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1280826061.149:13): user pid=1363 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=SYSTEM_RUNLEVEL msg=audit(1280826241.723:14): user pid=1380 uid=0 auid=4294967295 ses=4294967295 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=? res=success'
type=SYSTEM_SHUTDOWN msg=audit(1280826241.724:15): user pid=1380 uid=0 auid=4294967295 ses=4294967295 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=? res=success'
type=DAEMON_END msg=audit(1280826242.831:6971): auditd normal halt, sending auid=0 pid=1496 subj= res=success
type=DAEMON_START msg=audit(1280912136.909:2269): auditd start, ver=2.0.4 format=raw kernel=2.6.32-54.el6.i686 auid=4294967295 pid=1025 res=success
type=CONFIG_CHANGE msg=audit(1280912137.019:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1280912137.850:4): user pid=1086 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1280912137.850:5): user pid=1086 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1280912137.868:6): user pid=1086 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1280912137.868:7): user pid=1086 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1280912150.675:8): user pid=1367 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1280912150.680:9): user pid=1367 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1280912150.680:10): login pid=1367 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1280912150.683:11): user pid=1367 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1280912150.707:12): user pid=1369 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1280912150.710:13): user pid=1369 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=SYSTEM_RUNLEVEL msg=audit(1280912313.257:14): user pid=1401 uid=0 auid=0 ses=1 msg='old-level=3 new-level=0: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=SYSTEM_SHUTDOWN msg=audit(1280912313.257:15): user pid=1401 uid=0 auid=0 ses=1 msg='init: exe="/sbin/shutdown" hostname=? addr=? terminal=pts/0 res=success'
type=USER_END msg=audit(1280912313.591:16): user pid=1367 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1280912313.593:17): user pid=1367 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_END msg=audit(1280912314.420:2270): auditd normal halt, sending auid=0 pid=1516 subj= res=success
type=DAEMON_START msg=audit(1280912439.429:8246): auditd start, ver=2.0.4 format=raw kernel=2.6.32-54.el6.i686 auid=4294967295 pid=1053 res=success
type=CONFIG_CHANGE msg=audit(1280912439.539:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1280912439.857:4): user pid=1114 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1280912439.857:5): user pid=1114 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1280912439.869:6): user pid=1114 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1280912439.869:7): user pid=1114 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1280912461.726:8): user pid=1395 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_ACQ msg=audit(1280912461.726:9): user pid=1395 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=LOGIN msg=audit(1280912461.727:10): login pid=1395 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1280912461.727:11): user pid=1395 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=CRED_DISP msg=audit(1280912461.778:12): user pid=1395 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_END msg=audit(1280912461.778:13): user pid=1395 uid=0 auid=0 ses=1 msg='op=PAM:session_close acct="root" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
type=USER_ACCT msg=audit(1280912482.046:14): user pid=1407 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1280912482.051:15): user pid=1407 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1280912482.051:16): login pid=1407 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
type=USER_START msg=audit(1280912482.053:17): user pid=1407 uid=0 auid=0 ses=2 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1280912482.064:18): user pid=1409 uid=0 auid=0 ses=2 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1280912482.068:19): user pid=1409 uid=0 auid=0 ses=2 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1280913615.017:20): user pid=2909 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1280913615.022:21): user pid=2909 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1280913615.022:22): login pid=2909 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
type=USER_START msg=audit(1280913615.025:23): user pid=2909 uid=0 auid=0 ses=3 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1280913615.041:24): user pid=2915 uid=0 auid=0 ses=3 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/1 res=success'
type=CRED_REFR msg=audit(1280913615.050:25): user pid=2915 uid=0 auid=0 ses=3 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1280913681.894:26): user pid=2999 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1280913681.899:27): user pid=2999 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1280913681.899:28): login pid=2999 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=4
type=USER_START msg=audit(1280913681.902:29): user pid=2999 uid=0 auid=0 ses=4 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1280913681.908:30): user pid=3005 uid=0 auid=0 ses=4 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/2 res=success'
type=CRED_REFR msg=audit(1280913681.910:31): user pid=3005 uid=0 auid=0 ses=4 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=DAEMON_START msg=audit(1280913930.405:6492): auditd start, ver=2.0.4 format=raw kernel=2.6.32-54.el6.i686 auid=4294967295 pid=1065 res=success
type=CONFIG_CHANGE msg=audit(1280913930.515:3): audit_backlog_limit=320 old=64 auid=4294967295 ses=4294967295 res=1
type=USER_START msg=audit(1280913930.863:4): user pid=1126 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_ACQ msg=audit(1280913930.863:5): user pid=1126 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=CRED_DISP msg=audit(1280913930.874:6): user pid=1126 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_END msg=audit(1280913930.874:7): user pid=1126 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:session_close acct="root" exe="/sbin/runuser" hostname=? addr=? terminal=console res=success'
type=USER_ACCT msg=audit(1280913947.824:8): user pid=1406 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1280913947.828:9): user pid=1406 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1280913947.829:10): login pid=1406 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_START msg=audit(1280913947.831:11): user pid=1406 uid=0 auid=0 ses=1 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1280913947.840:12): user pid=1408 uid=0 auid=0 ses=1 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/0 res=success'
type=CRED_REFR msg=audit(1280913947.842:13): user pid=1408 uid=0 auid=0 ses=1 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1280914190.342:14): user pid=1745 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1280914190.346:15): user pid=1745 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1280914190.347:16): login pid=1745 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=2
type=USER_START msg=audit(1280914190.349:17): user pid=1745 uid=0 auid=0 ses=2 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1280914190.355:18): user pid=1747 uid=0 auid=0 ses=2 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/1 res=success'
type=CRED_REFR msg=audit(1280914190.358:19): user pid=1747 uid=0 auid=0 ses=2 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_END msg=audit(1280915177.899:20): user pid=1745 uid=0 auid=0 ses=2 msg='op=PAM:session_close acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_DISP msg=audit(1280915177.901:21): user pid=1745 uid=0 auid=0 ses=2 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_ACCT msg=audit(1280915221.073:22): user pid=1783 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=CRED_ACQ msg=audit(1280915221.080:23): user pid=1783 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=LOGIN msg=audit(1280915221.080:24): login pid=1783 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=3
type=USER_START msg=audit(1280915221.082:25): user pid=1783 uid=0 auid=0 ses=3 msg='op=PAM:session_open acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'
type=USER_LOGIN msg=audit(1280915221.092:26): user pid=1785 uid=0 auid=0 ses=3 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=/dev/pts/1 res=success'
type=CRED_REFR msg=audit(1280915221.095:27): user pid=1785 uid=0 auid=0 ses=3 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=daikengo.int.fabbione.net addr=192.168.0.2 terminal=ssh res=success'