Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- type=CRYPTO_KEY_USER msg=audit(1513843910.690:3762): pid=10375 uid=0 auid=0 ses=99 msg='op=destroy kind=server fp=ed:c8:cd:d7:77:3b:d4:d1:94:a0:dd:4a:4f:44:dc:90 [MD5] direction=? spid=10375 suid=0 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=pts/2 res=success'
- type=CRED_REFR msg=audit(1513843910.690:3763): pid=10375 uid=0 auid=0 ses=99 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=dimon-w.lanit addr=172.30.126.43 terminal=ssh res=success'
- type=SERVICE_STOP msg=audit(1513844050.350:3764): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=' comm="logstash" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
- type=SERVICE_START msg=audit(1513844050.350:3765): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=' comm="logstash" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
- type=USER_AUTH msg=audit(1513844057.442:3766): pid=10477 uid=0 auid=0 ses=99 msg='op=PAM:authentication acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/2 res=success'
- type=USER_ACCT msg=audit(1513844057.442:3767): pid=10477 uid=0 auid=0 ses=99 msg='op=PAM:accounting acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/2 res=success'
- type=CRED_ACQ msg=audit(1513844057.446:3768): pid=10477 uid=0 auid=0 ses=99 msg='op=PAM:setcred acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/2 res=success'
- type=USER_START msg=audit(1513844057.446:3769): pid=10477 uid=0 auid=0 ses=99 msg='op=PAM:session_open acct="root" exe="/usr/bin/su" hostname=? addr=? terminal=pts/2 res=success'
- type=USER_ACCT msg=audit(1513844101.814:3770): pid=10546 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_ACQ msg=audit(1513844101.814:3771): pid=10546 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=LOGIN msg=audit(1513844101.814:3772): pid=10546 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=100 res=1
- type=USER_START msg=audit(1513844101.822:3773): pid=10546 uid=0 auid=0 ses=100 msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_REFR msg=audit(1513844101.822:3774): pid=10546 uid=0 auid=0 ses=100 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_DISP msg=audit(1513844112.694:3775): pid=10546 uid=0 auid=0 ses=100 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=USER_END msg=audit(1513844112.698:3776): pid=10546 uid=0 auid=0 ses=100 msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=SERVICE_START msg=audit(1513844449.130:3777): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=' comm="systemd-tmpfiles-clean" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
- type=SERVICE_STOP msg=audit(1513844449.130:3778): pid=1 uid=0 auid=4294967295 ses=4294967295 msg=' comm="systemd-tmpfiles-clean" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
- type=CRYPTO_SESSION msg=audit(1513844682.354:3779): pid=3703 uid=0 auid=0 ses=3 msg='op=start direction=from-client cipher=aes256-ctr ksize=256 spid=3703 suid=0 rport=49173 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=CRYPTO_SESSION msg=audit(1513844682.354:3780): pid=3703 uid=0 auid=0 ses=3 msg='op=start direction=from-server cipher=aes256-ctr ksize=256 spid=3703 suid=0 rport=49173 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=CRYPTO_KEY_USER msg=audit(1513844682.502:3781): pid=3703 uid=0 auid=0 ses=3 msg='op=destroy kind=session fp=? direction=from-client spid=3703 suid=0 rport=49173 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=CRYPTO_KEY_USER msg=audit(1513844682.642:3782): pid=3703 uid=0 auid=0 ses=3 msg='op=destroy kind=session fp=? direction=from-server spid=3703 suid=0 rport=49173 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=USER_ACCT msg=audit(1513845001.702:3783): pid=10742 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_ACQ msg=audit(1513845001.702:3784): pid=10742 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=LOGIN msg=audit(1513845001.702:3785): pid=10742 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=101 res=1
- type=USER_START msg=audit(1513845001.706:3786): pid=10742 uid=0 auid=0 ses=101 msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_REFR msg=audit(1513845001.706:3787): pid=10742 uid=0 auid=0 ses=101 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_DISP msg=audit(1513845001.754:3788): pid=10742 uid=0 auid=0 ses=101 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=USER_END msg=audit(1513845001.758:3789): pid=10742 uid=0 auid=0 ses=101 msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=USER_ACCT msg=audit(1513845901.762:3790): pid=10810 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_ACQ msg=audit(1513845901.762:3791): pid=10810 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=LOGIN msg=audit(1513845901.762:3792): pid=10810 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=102 res=1
- type=USER_START msg=audit(1513845901.766:3793): pid=10810 uid=0 auid=0 ses=102 msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_REFR msg=audit(1513845901.766:3794): pid=10810 uid=0 auid=0 ses=102 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_DISP msg=audit(1513845901.802:3795): pid=10810 uid=0 auid=0 ses=102 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=USER_END msg=audit(1513845901.806:3796): pid=10810 uid=0 auid=0 ses=102 msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=USER_ACCT msg=audit(1513846801.810:3797): pid=10853 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_ACQ msg=audit(1513846801.810:3798): pid=10853 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=LOGIN msg=audit(1513846801.810:3799): pid=10853 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=103 res=1
- type=USER_START msg=audit(1513846801.814:3800): pid=10853 uid=0 auid=0 ses=103 msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_REFR msg=audit(1513846801.814:3801): pid=10853 uid=0 auid=0 ses=103 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRED_DISP msg=audit(1513846801.854:3802): pid=10853 uid=0 auid=0 ses=103 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=USER_END msg=audit(1513846801.858:3803): pid=10853 uid=0 auid=0 ses=103 msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'
- type=CRYPTO_SESSION msg=audit(1513847318.250:3804): pid=1550 uid=0 auid=0 ses=1 msg='op=start direction=from-client cipher=aes256-ctr ksize=256 spid=1550 suid=0 rport=65450 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=CRYPTO_SESSION msg=audit(1513847318.250:3805): pid=1550 uid=0 auid=0 ses=1 msg='op=start direction=from-server cipher=aes256-ctr ksize=256 spid=1550 suid=0 rport=65450 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=CRYPTO_KEY_USER msg=audit(1513847318.386:3806): pid=1550 uid=0 auid=0 ses=1 msg='op=destroy kind=session fp=? direction=from-client spid=1550 suid=0 rport=65450 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=CRYPTO_KEY_USER msg=audit(1513847318.526:3807): pid=1550 uid=0 auid=0 ses=1 msg='op=destroy kind=session fp=? direction=from-server spid=1550 suid=0 rport=65450 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=CRYPTO_SESSION msg=audit(1513847505.174:3808): pid=10370 uid=0 auid=0 ses=99 msg='op=start direction=from-client cipher=aes256-ctr ksize=256 spid=10370 suid=0 rport=51541 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=CRYPTO_SESSION msg=audit(1513847505.174:3809): pid=10370 uid=0 auid=0 ses=99 msg='op=start direction=from-server cipher=aes256-ctr ksize=256 spid=10370 suid=0 rport=51541 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=CRYPTO_KEY_USER msg=audit(1513847505.310:3810): pid=10370 uid=0 auid=0 ses=99 msg='op=destroy kind=session fp=? direction=from-client spid=10370 suid=0 rport=51541 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=CRYPTO_KEY_USER msg=audit(1513847505.450:3811): pid=10370 uid=0 auid=0 ses=99 msg='op=destroy kind=session fp=? direction=from-server spid=10370 suid=0 rport=51541 laddr=172.29.39.10 lport=22 exe="/usr/sbin/sshd" hostname=? addr=172.30.126.43 terminal=? res=success'
- type=CONFIG_CHANGE msg=audit(1513847662.074:3818): auid=0 ses=99 op="updated rules" path="/etc/passwd" key="identity" list=4 res=1
- type=SYSCALL msg=audit(1513847662.070:3819): arch=c000003e syscall=82 success=yes exit=0 a0=7ffc3d36d230 a1=7fd84a86f1a0 a2=7ffc3d36d1a0 a3=7ffc3d36ceb0 items=5 ppid=10478 pid=10925 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="useradd" exe="/usr/sbin/useradd" key="identity"
- type=CWD msg=audit(1513847662.070:3819): cwd="/root"
- type=PATH msg=audit(1513847662.070:3819): item=0 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
- type=PATH msg=audit(1513847662.070:3819): item=1 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
- type=PATH msg=audit(1513847662.070:3819): item=2 name="/etc/passwd+" inode=12171279 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
- type=PATH msg=audit(1513847662.070:3819): item=3 name="/etc/passwd" inode=12122424 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
- type=PATH msg=audit(1513847662.070:3819): item=4 name="/etc/passwd" inode=12171279 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE
- type=CONFIG_CHANGE msg=audit(1513847662.074:3820): auid=0 ses=99 op="updated rules" path="/etc/shadow" key="identity" list=4 res=1
- type=SYSCALL msg=audit(1513847662.074:3821): arch=c000003e syscall=82 success=yes exit=0 a0=7ffc3d36d230 a1=7fd84a86f640 a2=7ffc3d36d1a0 a3=0 items=5 ppid=10478 pid=10925 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="useradd" exe="/usr/sbin/useradd" key="identity"
- type=CWD msg=audit(1513847662.074:3821): cwd="/root"
- type=PATH msg=audit(1513847662.074:3821): item=0 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
- type=PATH msg=audit(1513847662.074:3821): item=1 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
- type=PATH msg=audit(1513847662.074:3821): item=2 name="/etc/shadow+" inode=12171280 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=DELETE
- type=PATH msg=audit(1513847662.074:3821): item=3 name="/etc/shadow" inode=12122425 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=DELETE
- type=PATH msg=audit(1513847662.074:3821): item=4 name="/etc/shadow" inode=12171280 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=CREATE
- type=USER_AUTH msg=audit(1513847671.818:3822): pid=10931 uid=0 auid=0 ses=99 msg='op=PAM:authentication acct="root" exe="/usr/sbin/userdel" hostname=? addr=? terminal=pts/2 res=success'
- type=USER_ACCT msg=audit(1513847671.818:3823): pid=10931 uid=0 auid=0 ses=99 msg='op=PAM:accounting acct="root" exe="/usr/sbin/userdel" hostname=? addr=? terminal=pts/2 res=success'
- type=USER_ACCT msg=audit(1513847671.842:3824): pid=10933 uid=0 auid=0 ses=99 msg='op=PAM:accounting acct="testuser" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
- type=CRED_ACQ msg=audit(1513847671.842:3825): pid=10933 uid=0 auid=0 ses=99 msg='op=PAM:setcred acct="testuser" exe="/usr/bin/crontab" hostname=? addr=? terminal=cron res=success'
- type=SYSCALL msg=audit(1513847671.858:3826): arch=c000003e syscall=2 success=yes exit=5 a0=7fc4ab49bd40 a1=20902 a2=0 a3=7ffe2300b1d0 items=1 ppid=10478 pid=10931 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="userdel" exe="/usr/sbin/userdel" key="identity"
- type=CWD msg=audit(1513847671.858:3826): cwd="/root"
- type=PATH msg=audit(1513847671.858:3826): item=0 name="/etc/passwd" inode=12171279 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
- type=SYSCALL msg=audit(1513847671.858:3827): arch=c000003e syscall=2 success=yes exit=6 a0=7fc4ab49c1e0 a1=20902 a2=0 a3=0 items=1 ppid=10478 pid=10931 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="userdel" exe="/usr/sbin/userdel" key="identity"
- type=CWD msg=audit(1513847671.858:3827): cwd="/root"
- type=PATH msg=audit(1513847671.858:3827): item=0 name="/etc/shadow" inode=12171280 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=NORMAL
- type=SYSCALL msg=audit(1513847671.858:3828): arch=c000003e syscall=2 success=yes exit=7 a0=7fc4ab49b8a0 a1=20902 a2=0 a3=0 items=1 ppid=10478 pid=10931 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="userdel" exe="/usr/sbin/userdel" key="identity"
- type=CWD msg=audit(1513847671.858:3828): cwd="/root"
- type=PATH msg=audit(1513847671.858:3828): item=0 name="/etc/group" inode=105337 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL
- type=DEL_USER msg=audit(1513847671.858:3829): pid=10931 uid=0 auid=0 ses=99 msg='op=deleting user entries id=1002 exe="/usr/sbin/userdel" hostname=? addr=? terminal=pts/2 res=success'
- type=CONFIG_CHANGE msg=audit(1513847671.878:3830): auid=0 ses=99 op="updated rules" path="/etc/passwd" key="identity" list=4 res=1
- type=SYSCALL msg=audit(1513847671.878:3831): arch=c000003e syscall=82 success=yes exit=0 a0=7ffe2300b010 a1=7fc4ab49bd40 a2=7ffe2300af80 a3=7ffe2300ac90 items=5 ppid=10478 pid=10931 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="userdel" exe="/usr/sbin/userdel" key="identity"
- type=CWD msg=audit(1513847671.878:3831): cwd="/root"
- type=PATH msg=audit(1513847671.878:3831): item=0 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
- type=PATH msg=audit(1513847671.878:3831): item=1 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
- type=PATH msg=audit(1513847671.878:3831): item=2 name="/etc/passwd+" inode=12171284 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
- type=PATH msg=audit(1513847671.878:3831): item=3 name="/etc/passwd" inode=12171279 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=DELETE
- type=PATH msg=audit(1513847671.878:3831): item=4 name="/etc/passwd" inode=12171284 dev=00:22 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE
- type=CONFIG_CHANGE msg=audit(1513847671.894:3832): auid=0 ses=99 op="updated rules" path="/etc/shadow" key="identity" list=4 res=1
- type=SYSCALL msg=audit(1513847671.894:3833): arch=c000003e syscall=82 success=yes exit=0 a0=7ffe2300b010 a1=7fc4ab49c1e0 a2=7ffe2300af80 a3=4833555170593953 items=5 ppid=10478 pid=10931 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts2 ses=99 comm="userdel" exe="/usr/sbin/userdel" key="identity"
- type=CWD msg=audit(1513847671.894:3833): cwd="/root"
- type=PATH msg=audit(1513847671.894:3833): item=0 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
- type=PATH msg=audit(1513847671.894:3833): item=1 name="/etc/" inode=257 dev=00:22 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT
- type=PATH msg=audit(1513847671.894:3833): item=2 name="/etc/shadow+" inode=12171285 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=DELETE
- type=PATH msg=audit(1513847671.894:3833): item=3 name="/etc/shadow" inode=12171280 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=DELETE
- type=PATH msg=audit(1513847671.894:3833): item=4 name="/etc/shadow" inode=12171285 dev=00:22 mode=0100640 ouid=0 ogid=15 rdev=00:00 nametype=CREATE
Advertisement
Add Comment
Please, Sign In to add comment