* Patch to auparse to handle out of order messages 3 of 3
@ 2016-01-06 10:30 Burn Alting
2016-01-07 22:31 ` Steve Grubb
0 siblings, 1 reply; 7+ messages in thread
From: Burn Alting @ 2016-01-06 10:30 UTC (permalink / raw)
To: linux-audit@redhat.com
[-- Attachment #1: Type: text/plain, Size: 47 bytes --]
#3 - modify the standard auparse() test code.
[-- Attachment #2: audit-2.4.5-3.patch --]
[-- Type: text/x-patch, Size: 287047 bytes --]
diff -Npru audit-2.4.5.orig/auparse/test/auditd_raw.sed audit-2.4.5/auparse/test/auditd_raw.sed
--- audit-2.4.5.orig/auparse/test/auditd_raw.sed 1970-01-01 10:00:00.000000000 +1000
+++ audit-2.4.5/auparse/test/auditd_raw.sed 2016-01-04 22:47:35.409251185 +1100
@@ -0,0 +1,32 @@
+s/ cwd/ cwd/
+s/ comm=/ comm=/
+s/msg='//
+s/(hostname=/hostname=/
+s/success)/success/
+s/ : exe=/ exe=/
+s/'$//
+s/): a/): a/
+s/, addr=/ addr=/
+s/, terminal=/ terminal=/
+s/tty pid=/pid=/
+s/Unknown permission start for class system //
+s/Unknown permission stop for class system //
+s/ exe=/ exe=/
+s/ pam: default-context/ default-context/
+s/ avc: denied { stop } for auid=/ auid=/
+s/old ses=/ses=/
+s/new ses=/ses=/
+s/old auid=/auid=/
+s/login pid=/pid=/
+s/user pid=/pid=/
+s/new auid=/auid=/
+s/auditd start, ver=/ver=/
+s/policy loaded auid=/auid=/
+s/auditd normal halt, sending auid=/auid=/
+s/op=change password id=/op=change id=/
+s/avc: received policyload notice (seqno=\(\d+)\))/seqno=\1/
+s/PAM: accounting acct/acct/
+s/PAM: session open acct/acct/
+s/PAM: session close acct/acct/
+s/PAM: setcred acct/acct/
+s/avc: denied { read write } for pid=/seresult=denied seperms=read,write pid=/
diff -Npru audit-2.4.5.orig/auparse/test/auparselol_test.c audit-2.4.5/auparse/test/auparselol_test.c
--- audit-2.4.5.orig/auparse/test/auparselol_test.c 1970-01-01 10:00:00.000000000 +1000
+++ audit-2.4.5/auparse/test/auparselol_test.c 2016-01-03 15:00:15.659327719 +1100
@@ -0,0 +1,250 @@
+#include "config.h"
+#include <stdio.h>
+#include <locale.h>
+#include <string.h>
+#include <unistd.h>
+#include <errno.h>
+#include <pwd.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include "libaudit.h"
+#include "auparse.h"
+
+/*
+ * Tool to exercise the auparse library input and processing capability
+ * Based on the code example shown in auparse_feed manual entry
+ *
+ * Standard test would be
+ * mkdir /tmp/auparse_test
+ * cp /var/log/audit/audit.log /tmp/auparse_test/audit.log
+ * sed -f auparse_patch.sed /tmp/auparse_test/audit.log | sort > /tmp/auparse_test/auparse.raw
+ * auparselol_test --check -f /tmp/auparse_test/audit.log | sort > /tmp/auparse_test/auparse.new
+ * diff /tmp/auparse_test/auparse.raw /tmp/auparse_test/auparse.new
+ * and the ouput of the diff should be zero or explainable (and hence expand the auparse_patch.sed file)
+ *
+ */
+
+/*
+ * Flags bitset
+ */
+unsigned flags = 0x0;
+
+#define F_VERBOSE 0x00000001
+#define F_CHECK 0x00000002
+#define F_USESTDIN 0x00000004
+
+/*
+ * Print a null terminated string, escaping chararters from the given set
+ */
+void print_escape(FILE * fd, char *str, const char *escape)
+{
+ register char *s = str;
+ int ch;
+
+ while ((ch = (int) *s++)) {
+ if (strrchr(escape, ch))
+ fputc('\\', fd);
+ fputc(ch, fd);
+ }
+}
+
+/*
+ * auparse_callback - callback routine to be executed once a complete event is composed
+ */
+void
+auparse_callback(auparse_state_t * au, auparse_cb_event_t cb_event_type,
+ void *user_data)
+{
+ int *event_cnt = (int *) user_data;
+
+ if (cb_event_type == AUPARSE_CB_EVENT_READY) {
+ if (auparse_first_record(au) <= 0)
+ return; /* If no first record, then no event ! */
+
+ if (!(flags & F_CHECK))
+ printf("event=%d records=%d\n", *event_cnt,
+ auparse_get_num_records(au));
+ do {
+ const au_event_t *e = auparse_get_timestamp(au);
+ if (e == NULL)
+ return; /* If no timestamp, then no event */
+
+ /* If checking, we just emit the raw record again
+ */
+ if (flags & F_CHECK) {
+ if (e->host != NULL)
+ printf("node=%s type=%s msg=audit(%u.%3.3u:%lu):",
+ e->host, auparse_get_type_name(au),
+ (unsigned) e->sec, e->milli, e->serial);
+ else
+ printf("type=%s msg=audit(%u.%3.3u:%lu):",
+ auparse_get_type_name(au),
+ (unsigned) e->sec, e->milli, e->serial);
+ auparse_first_field(au); /* Move to first field */
+ do {
+ const char *fname = auparse_get_field_name(au);
+
+ /* We ignore the node and type fields */
+ if (strcmp(fname, "type") == 0
+ || strcmp(fname, "node") == 0)
+ continue;
+ printf(" %s=%s", fname, auparse_get_field_str(au));
+ } while (auparse_next_field(au) > 0);
+ printf("\n");
+ continue;
+ }
+
+ printf("fields=%d\t", auparse_get_num_fields(au));
+ printf("type=%d (%s) ", auparse_get_type(au),
+ auparse_get_type_name(au));
+ printf("event_tid=%u.%3.3u:%lu ",
+ (unsigned) e->sec, e->milli, e->serial);
+ if (flags & F_VERBOSE) {
+ char *fv, *ifv = NULL;
+ auparse_first_field(au); /* Move to first field */
+ do {
+ fv = (char *) auparse_get_field_str(au);
+ ifv = (char *) auparse_interpret_field(au);
+ printf("%s=", auparse_get_field_name(au));
+ print_escape(stdout, fv, "=()");
+ printf(" (");
+ print_escape(stdout, ifv, "=()");
+ printf(") ");
+ }
+ while (auparse_next_field(au) > 0);
+ }
+ printf("\n");
+ }
+ while (auparse_next_record(au) > 0);
+ (*event_cnt)++;
+ }
+}
+
+void usage(void)
+{
+ fprintf(stderr,
+ "usage: auparselol_test [--stdin] [-f file] [--verbose] [--check] [--escape R|T|S|Q]\n");
+}
+
+int main(int argc, char **argv)
+{
+ char *filename = NULL;
+ auparse_esc_t em;
+ FILE *fd;
+#define BUFSZ 2048
+ char buf[BUFSZ];
+ size_t len;
+ int *event_cnt = NULL;
+ auparse_state_t *au;
+ int i;
+ /* Argument parsing */
+ while (1) {
+ int this_option_optind = optind ? optind : 1;
+ int option_index = 0;
+ int c;
+ static struct option long_options[] = {
+ { "verbose", no_argument, 0, 'v'},
+ { "file", required_argument, 0, 'f'},
+ { "stdin", no_argument, 0, 's'},
+ { "check", no_argument, 0, 'c'},
+ { "escape", required_argument, 0, 'e'},
+ { 0, 0, 0, 0}
+ };
+ c = getopt_long(argc, argv, "cvf:e:s", long_options,
+ &option_index);
+ if (c == -1)
+ break;
+ switch (c) {
+ case 'e': /* escape mode */
+ switch (*optarg) {
+ case 'R':
+ case 'r':
+ em = AUPARSE_ESC_RAW;
+ break;
+ case 'T':
+ case 't':
+ em = AUPARSE_ESC_TTY;
+ break;
+ case 'S':
+ case 's':
+ em = AUPARSE_ESC_SHELL;
+ break;
+ case 'Q':
+ case 'q':
+ em = AUPARSE_ESC_SHELL_QUOTE;
+ break;
+ default:
+ fprintf(stderr,
+ "%s: Unknown escape character 0x%2.2X\n",
+ argv[0], *optarg);
+ usage();
+ return 1;
+ }
+ auparse_set_escape_mode(em);
+ break;
+ case 'c': /* check */
+ flags |= F_CHECK;
+ break;
+ case 'v': /* verbose */
+ flags |= F_VERBOSE;
+ break;
+ case 's': /* stdin */
+ flags |= F_USESTDIN;
+ break;
+ case 'f': /* file */
+ filename = optarg;
+ break;
+ case '?':
+ default:
+ fprintf(stderr, "%s: Unknown option 0x%2.2X\n", argv[0], c);
+ usage();
+ return 1;
+ }
+ }
+ if ((flags & F_USESTDIN) && filename != NULL) {
+ fprintf(stderr,
+ "%s: --stdin cannot be used with file argument\n",
+ argv[0]);
+ usage();
+ return 1;
+ }
+ if (!(flags & F_USESTDIN) && filename == NULL) {
+ fprintf(stderr,
+ "%s: Missing --stdin or -f file argument\n", argv[0]);
+ usage();
+ return 1;
+ }
+
+ if ((event_cnt = malloc(sizeof(int))) == NULL) {
+ fprintf(stderr,
+ "%s: No memory to allocate %u bytes\n",
+ argv[0], sizeof(int));
+ return 1;
+ }
+
+ if (flags & F_USESTDIN) {
+ fd = stdin;
+ } else {
+ if ((fd = fopen(filename, "r")) == NULL) {
+ fprintf(stderr, "could not open ’%s’, %s\n",
+ filename, strerror(errno));
+ (void) free(event_cnt);
+ return 1;
+ }
+ }
+
+ au = auparse_init(AUSOURCE_FEED, NULL);
+ *event_cnt = 1;
+ auparse_add_callback(au, auparse_callback, event_cnt, free);
+ i = 0;
+ while ((len = fread(buf, 1, sizeof(buf), fd))) {
+
+ auparse_feed(au, buf, len);
+ i++;
+ }
+ auparse_flush_feed(au);
+ auparse_destroy(au); /* this also free's event_cnt */
+ if (!(flags & F_USESTDIN))
+ fclose(fd);
+ return 0;
+}
diff -Npru audit-2.4.5.orig/auparse/test/auparse_test.py audit-2.4.5/auparse/test/auparse_test.py
--- audit-2.4.5.orig/auparse/test/auparse_test.py 2015-12-19 06:20:59.000000000 +1100
+++ audit-2.4.5/auparse/test/auparse_test.py 2016-01-04 19:15:33.547099344 +1100
@@ -169,6 +169,7 @@ print "Test 2 Done\n"
# Reset, now lets go to beginning and walk the list manually */
print "Starting Test 3, walk events, records of 1 buffer..."
au = auparse.AuParser(auparse.AUSOURCE_BUFFER, buf[1])
+au.reset()
light_test(au);
print "Test 3 Done\n"
@@ -179,7 +180,7 @@ print "Test 4 Done\n"
print "Starting Test 5, walk events, records of 2 files..."
au = auparse.AuParser(auparse.AUSOURCE_FILE_ARRAY, files);
-walk_test(au);
+walk_test(au);
print "Test 5 Done\n"
print "Starting Test 6, search..."
diff -Npru audit-2.4.5.orig/auparse/test/auparse_test.ref audit-2.4.5/auparse/test/auparse_test.ref
--- audit-2.4.5.orig/auparse/test/auparse_test.ref 2015-12-19 06:20:59.000000000 +1100
+++ audit-2.4.5/auparse/test/auparse_test.ref 2016-01-03 15:07:51.413250806 +1100
@@ -27,6 +27,21 @@ event 1 has 1 records
auid=848 (unknown(848))
event 2 has 1 records
+ record 1 of type 1112(USER_LOGIN) has 10 fields
+ line=3 file=None
+ event time: 1143146623.879:146, host=?
+ type=USER_LOGIN (USER_LOGIN)
+ pid=2027 (2027)
+ uid=0 (root)
+ auid=848 (unknown(848))
+ uid=848 (unknown(848))
+ exe="/bin/login" (/bin/login)
+ hostname=? (?)
+ addr=? (?)
+ terminal=tty3 (tty3)
+ res=success (success)
+
+event 3 has 1 records
record 1 of type 1300(SYSCALL) has 24 fields
line=2 file=None
event time: 1143146623.875:143, host=?
@@ -55,21 +70,6 @@ event 2 has 1 records
exe="/bin/login" (/bin/login)
subj=system_u:system_r:local_login_t:s0-s0:c0.c255 (system_u:system_r:local_login_t:s0-s0:c0.c255)
-event 3 has 1 records
- record 1 of type 1112(USER_LOGIN) has 10 fields
- line=3 file=None
- event time: 1143146623.879:146, host=?
- type=USER_LOGIN (USER_LOGIN)
- pid=2027 (2027)
- uid=0 (root)
- auid=848 (unknown(848))
- uid=848 (unknown(848))
- exe="/bin/login" (/bin/login)
- hostname=? (?)
- addr=? (?)
- terminal=tty3 (tty3)
- res=success (success)
-
Test 2 Done
Starting Test 3, walk events, records of 1 buffer...
@@ -560,9 +560,9 @@ auid exists...which is correct
Testing BUFFER_ARRAY, stop on field
Found auid = 848
Testing BUFFER_ARRAY, stop on record
-Found type = SYSCALL
+Found type = USER_LOGIN
Testing BUFFER_ARRAY, stop on event
-Found type = SYSCALL
+Found type = USER_LOGIN
Testing test.log, stop on field
Found auid = 4294967295
Testing test.log, stop on record
@@ -595,6 +595,21 @@ event 1 has 1 records
auid=848 (unknown(848))
event 2 has 1 records
+ record 1 of type 1112(USER_LOGIN) has 10 fields
+ line=3 file=None
+ event time: 1143146623.879:146, host=?
+ type=USER_LOGIN (USER_LOGIN)
+ pid=2027 (2027)
+ uid=0 (root)
+ auid=848 (unknown(848))
+ uid=848 (unknown(848))
+ exe="/bin/login" (/bin/login)
+ hostname=? (?)
+ addr=? (?)
+ terminal=tty3 (tty3)
+ res=success (success)
+
+event 3 has 1 records
record 1 of type 1300(SYSCALL) has 24 fields
line=2 file=None
event time: 1143146623.875:143, host=?
@@ -623,21 +638,6 @@ event 2 has 1 records
exe="/bin/login" (/bin/login)
subj=system_u:system_r:local_login_t:s0-s0:c0.c255 (system_u:system_r:local_login_t:s0-s0:c0.c255)
-event 3 has 1 records
- record 1 of type 1112(USER_LOGIN) has 10 fields
- line=3 file=None
- event time: 1143146623.879:146, host=?
- type=USER_LOGIN (USER_LOGIN)
- pid=2027 (2027)
- uid=0 (root)
- auid=848 (unknown(848))
- uid=848 (unknown(848))
- exe="/bin/login" (/bin/login)
- hostname=? (?)
- addr=? (?)
- terminal=tty3 (tty3)
- res=success (success)
-
Test 9 Done
Starting Test 10, file feed...
diff -Npru audit-2.4.5.orig/auparse/test/auparse_test.ref.py audit-2.4.5/auparse/test/auparse_test.ref.py
--- audit-2.4.5.orig/auparse/test/auparse_test.ref.py 2015-12-19 06:20:59.000000000 +1100
+++ audit-2.4.5/auparse/test/auparse_test.ref.py 2016-01-04 19:43:07.617095931 +1100
@@ -19,6 +19,21 @@ event 1 has 1 records
auid=848 (unknown(848))
event 2 has 1 records
+ record 1 of type 1112(USER_LOGIN) has 10 fields
+ line=3 file=None
+ event time: 1143146623.879:146, host=(null)
+ type=USER_LOGIN (USER_LOGIN)
+ pid=2027 (2027)
+ uid=0 (root)
+ auid=848 (unknown(848))
+ uid=848 (unknown(848))
+ exe="/bin/login" (/bin/login)
+ hostname=? (?)
+ addr=? (?)
+ terminal=tty3 (tty3)
+ res=success (success)
+
+event 3 has 1 records
record 1 of type 1300(SYSCALL) has 24 fields
line=2 file=None
event time: 1143146623.875:143, host=(null)
@@ -47,21 +62,6 @@ event 2 has 1 records
exe="/bin/login" (/bin/login)
subj=system_u:system_r:local_login_t:s0-s0:c0.c255 (system_u:system_r:local_login_t:s0-s0:c0.c255)
-event 3 has 1 records
- record 1 of type 1112(USER_LOGIN) has 10 fields
- line=3 file=None
- event time: 1143146623.879:146, host=(null)
- type=USER_LOGIN (USER_LOGIN)
- pid=2027 (2027)
- uid=0 (root)
- auid=848 (unknown(848))
- uid=848 (unknown(848))
- exe="/bin/login" (/bin/login)
- hostname=? (?)
- addr=? (?)
- terminal=tty3 (tty3)
- res=success (success)
-
Test 2 Done
Starting Test 3, walk events, records of 1 buffer...
@@ -552,9 +552,9 @@ auid exists...which is correct
Testing BUFFER_ARRAY, stop on field
Found auid = 848
Testing BUFFER_ARRAY, stop on record
-Found type = SYSCALL
+Found type = USER_LOGIN
Testing BUFFER_ARRAY, stop on event
-Found type = SYSCALL
+Found type = USER_LOGIN
Testing test.log, stop on field
Found auid = 4294967295
Testing test.log, stop on record
@@ -585,6 +585,21 @@ event 1 has 1 records
auid=848 (unknown(848))
event 2 has 1 records
+ record 1 of type 1112(USER_LOGIN) has 10 fields
+ line=3 file=None
+ event time: 1143146623.879:146, host=(null)
+ type=USER_LOGIN (USER_LOGIN)
+ pid=2027 (2027)
+ uid=0 (root)
+ auid=848 (unknown(848))
+ uid=848 (unknown(848))
+ exe="/bin/login" (/bin/login)
+ hostname=? (?)
+ addr=? (?)
+ terminal=tty3 (tty3)
+ res=success (success)
+
+event 3 has 1 records
record 1 of type 1300(SYSCALL) has 24 fields
line=2 file=None
event time: 1143146623.875:143, host=(null)
@@ -613,21 +628,6 @@ event 2 has 1 records
exe="/bin/login" (/bin/login)
subj=system_u:system_r:local_login_t:s0-s0:c0.c255 (system_u:system_r:local_login_t:s0-s0:c0.c255)
-event 3 has 1 records
- record 1 of type 1112(USER_LOGIN) has 10 fields
- line=3 file=None
- event time: 1143146623.879:146, host=(null)
- type=USER_LOGIN (USER_LOGIN)
- pid=2027 (2027)
- uid=0 (root)
- auid=848 (unknown(848))
- uid=848 (unknown(848))
- exe="/bin/login" (/bin/login)
- hostname=? (?)
- addr=? (?)
- terminal=tty3 (tty3)
- res=success (success)
-
Test 9 Done
Starting Test 10, file feed...
diff -Npru audit-2.4.5.orig/auparse/test/Makefile.am audit-2.4.5/auparse/test/Makefile.am
--- audit-2.4.5.orig/auparse/test/Makefile.am 2015-12-19 06:20:59.000000000 +1100
+++ audit-2.4.5/auparse/test/Makefile.am 2016-01-06 21:13:10.321913092 +1100
@@ -22,7 +22,7 @@
CONFIG_CLEAN_FILES = *.loT *.rej *.orig *.cur
AUTOMAKE_OPTIONS = no-dependencies
-check_PROGRAMS = auparse_test
+check_PROGRAMS = auparse_test auparselol_test
dist_check_SCRIPTS = auparse_test.py
EXTRA_DIST = auparse_test.ref auparse_test.ref.py test.log test2.log
@@ -33,14 +33,22 @@ auparse_test_LDFLAGS = -static
auparse_test_LDADD = ${top_builddir}/auparse/libauparse.la \
${top_builddir}/lib/libaudit.la
+auparselol_test_SOURCES = auparselol_test.c
+auparselol_test_LDFLAGS = -static
+auparselol_test_LDADD = ${top_builddir}/auparse/libauparse.la \
+ ${top_builddir}/lib/libaudit.la
+
drop_srcdir = sed 's,$(srcdir)/test,test,'
-check: auparse_test
+check: auparse_test auparselol_test
test "$(top_srcdir)" = "$(top_builddir)" || \
cp $(top_srcdir)/auparse/test/test*.log .
LC_ALL=C \
./auparse_test > auparse_test.cur
diff -u $(top_srcdir)/auparse/test/auparse_test.ref auparse_test.cur
+ ./auparselol_test -f test3.log --check | sort > auparse_test.cur
+ sed -f ./auditd_raw.sed test3.log | sort > auparse_test.raw
+ diff -u auparse_test.raw auparse_test.cur
if HAVE_PYTHON
cp ${top_builddir}/bindings/swig/python/.libs/_audit.so ${top_builddir}/bindings/swig/python
PYTHONPATH=${top_builddir}/bindings/python/python2/.libs/:${top_builddir}/bindings/swig/python:${top_builddir}/bindings/swig/python/.libs \
@@ -51,9 +59,12 @@ if HAVE_PYTHON
endif
echo -e "===================\nAuparse Test Passes\n==================="
-diffcheck: auparse_test
+diffcheck: auparse_test auparselol_test
./auparse_test > auparse_test.cur
diff -u $(srcdir)/auparse_test.ref auparse_test.cur
+ ./auparselol_test -f test3.log --check | sort > auparse_test.cur
+ sed -f ./auditd_raw.sed test3.log | sort > auparse_test.raw
+ diff -u auparse_test.raw auparse_test.cur
memcheck: auparse_test
valgrind --leak-check=yes --show-reachable=yes ./auparse_test
@@ -85,6 +96,7 @@ endif
clean-generic:
$(RM) *.cur
+ $(RM) auparse_test.raw
if HAVE_PYTHON
$(RM) ${top_builddir}/bindings/swig/python/_audit.so
endif
diff -Npru audit-2.4.5.orig/auparse/test/Makefile.in audit-2.4.5/auparse/test/Makefile.in
--- audit-2.4.5.orig/auparse/test/Makefile.in 2015-12-19 06:21:09.000000000 +1100
+++ audit-2.4.5/auparse/test/Makefile.in 2016-01-06 21:14:10.499551952 +1100
@@ -110,7 +110,7 @@ POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
target_triplet = @target@
-check_PROGRAMS = auparse_test$(EXEEXT)
+check_PROGRAMS = auparse_test$(EXEEXT) auparselol_test$(EXEEXT)
subdir = auparse/test
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/ax_prog_cc_for_build.m4 \
@@ -129,6 +129,10 @@ am_auparse_test_OBJECTS = auparse_test.$
auparse_test_OBJECTS = $(am_auparse_test_OBJECTS)
auparse_test_DEPENDENCIES = ${top_builddir}/auparse/libauparse.la \
${top_builddir}/lib/libaudit.la
+am_auparselol_test_OBJECTS = auparselol_test.$(OBJEXT)
+auparselol_test_OBJECTS = $(am_auparselol_test_OBJECTS)
+auparselol_test_DEPENDENCIES = ${top_builddir}/auparse/libauparse.la \
+ ${top_builddir}/lib/libaudit.la
AM_V_lt = $(am__v_lt_@AM_V@)
am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
am__v_lt_0 = --silent
@@ -136,6 +140,9 @@ am__v_lt_1 =
auparse_test_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
$(auparse_test_LDFLAGS) $(LDFLAGS) -o $@
+auparselol_test_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+ $(auparselol_test_LDFLAGS) $(LDFLAGS) -o $@
AM_V_P = $(am__v_P_@AM_V@)
am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
am__v_P_0 = false
@@ -169,8 +176,8 @@ AM_V_CCLD = $(am__v_CCLD_@AM_V@)
am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
am__v_CCLD_0 = @echo " CCLD " $@;
am__v_CCLD_1 =
-SOURCES = $(auparse_test_SOURCES)
-DIST_SOURCES = $(auparse_test_SOURCES)
+SOURCES = $(auparse_test_SOURCES) $(auparselol_test_SOURCES)
+DIST_SOURCES = $(auparse_test_SOURCES) $(auparselol_test_SOURCES)
am__can_run_installinfo = \
case $$AM_UPDATE_INFO_DIR in \
n|no|NO) false;; \
@@ -363,6 +370,10 @@ auparse_test_SOURCES = auparse_test.c
auparse_test_LDFLAGS = -static
auparse_test_LDADD = ${top_builddir}/auparse/libauparse.la \
${top_builddir}/lib/libaudit.la
+auparselol_test_SOURCES = auparselol_test.c
+auparselol_test_LDFLAGS = -static
+auparselol_test_LDADD = ${top_builddir}/auparse/libauparse.la \
+ ${top_builddir}/lib/libaudit.la
drop_srcdir = sed 's,$(srcdir)/test,test,'
all: all-am
@@ -412,6 +423,11 @@ auparse_test$(EXEEXT): $(auparse_test_OB
@rm -f auparse_test$(EXEEXT)
$(AM_V_CCLD)$(auparse_test_LINK) $(auparse_test_OBJECTS) $(auparse_test_LDADD) $(LIBS)
+auparselol_test$(EXEEXT): $(auparselol_test_OBJECTS) $(auparselol_test_DEPENDENCIES) $(EXTRA_auparselol_test_DEPENDENCIES)
+ @rm -f auparselol_test$(EXEEXT)
+ $(AM_V_CCLD)$(auparselol_test_LINK) $(auparselol_test_OBJECTS) $(auparselol_test_LDADD) $(LIBS)
+
+
mostlyclean-compile:
-rm -f *.$(OBJEXT)
@@ -637,12 +653,15 @@ uninstall-am:
.PRECIOUS: Makefile
-check: auparse_test
+check: auparse_test auparselol_test
test "$(top_srcdir)" = "$(top_builddir)" || \
cp $(top_srcdir)/auparse/test/test*.log .
LC_ALL=C \
./auparse_test > auparse_test.cur
diff -u $(top_srcdir)/auparse/test/auparse_test.ref auparse_test.cur
+ ./auparselol_test -f test3.log --check | sort > auparse_test.cur
+ sed -f ./auditd_raw.sed test3.log | sort > auparse_test.raw
+ diff -u auparse_test.raw auparse_test.cur
@HAVE_PYTHON_TRUE@ cp ${top_builddir}/bindings/swig/python/.libs/_audit.so ${top_builddir}/bindings/swig/python
@HAVE_PYTHON_TRUE@ PYTHONPATH=${top_builddir}/bindings/python/python2/.libs/:${top_builddir}/bindings/swig/python:${top_builddir}/bindings/swig/python/.libs \
@HAVE_PYTHON_TRUE@ LD_LIBRARY_PATH=${top_builddir}/auparse/.libs \
@@ -654,6 +673,9 @@ check: auparse_test
diffcheck: auparse_test
./auparse_test > auparse_test.cur
diff -u $(srcdir)/auparse_test.ref auparse_test.cur
+ ./auparselol_test -f test3.log --check | sort > auparse_test.cur
+ sed -f ./auditd_raw.sed test3.log | sort > auparse_test.raw
+ diff -u auparse_test.raw auparse_test.cur
memcheck: auparse_test
valgrind --leak-check=yes --show-reachable=yes ./auparse_test
@@ -679,6 +701,7 @@ pymemcheck: auparse_test.py
clean-generic:
$(RM) *.cur
+ $(RM) auparse_test.raw
@HAVE_PYTHON_TRUE@ $(RM) ${top_builddir}/bindings/swig/python/_audit.so
test "$(top_srcdir)" = "$(top_builddir)" || $(RM) test*.log
diff -Npru audit-2.4.5.orig/auparse/test/test3.log audit-2.4.5/auparse/test/test3.log
--- audit-2.4.5.orig/auparse/test/test3.log 1970-01-01 10:00:00.000000000 +1000
+++ audit-2.4.5/auparse/test/test3.log 2016-01-06 20:45:12.183983969 +1100
@@ -0,0 +1,1184 @@
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.389:194432): arch=c000003e syscall=1 success=yes exit=1 a0=9 a1=564201849ef9 a2=1 a3=0 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.393:194431): arch=c000003e syscall=13 success=yes exit=0 a0=7 a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.393:194431): proctitle="bash"
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.389:194432): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194434): arch=c000003e syscall=228 success=yes exit=0 a0=7 a1=7ffdac6fe940 a2=564201867510 a3=a items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194434): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194435): arch=c000003e syscall=23 success=yes exit=1 a0=c a1=56420184ade0 a2=564201867510 a3=0 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194433): arch=c000003e syscall=13 success=yes exit=0 a0=b a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194433): proctitle="bash"
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194435): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194436): arch=c000003e syscall=13 success=yes exit=0 a0=1f a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194437): arch=c000003e syscall=14 success=yes exit=0 a0=0 a1=7ffdac6fe9a0 a2=7ffdac6fe920 a3=8 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194436): proctitle="bash"
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194437): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194438): arch=c000003e syscall=13 success=yes exit=0 a0=d a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194439): arch=c000003e syscall=14 success=yes exit=0 a0=2 a1=7ffdac6fe920 a2=0 a3=8 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194439): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194440): arch=c000003e syscall=228 success=yes exit=0 a0=7 a1=7ffdac6fe9c0 a2=564201867510 a3=8 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194438): proctitle="bash"
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194440): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194441): arch=c000003e syscall=13 success=yes exit=0 a0=e a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194442): arch=c000003e syscall=0 success=yes exit=2 a0=b a1=7ffdac6fa900 a2=4000 a3=8 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194441): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194443): arch=c000003e syscall=13 success=yes exit=0 a0=18 a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194442): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194444): arch=c000003e syscall=228 success=yes exit=0 a0=7 a1=7ffdac6fe940 a2=564201867510 a3=4000000 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194443): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194445): arch=c000003e syscall=13 success=yes exit=0 a0=19 a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194444): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194446): arch=c000003e syscall=23 success=yes exit=1 a0=c a1=56420184ade0 a2=564201867510 a3=0 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194445): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194447): arch=c000003e syscall=13 success=yes exit=0 a0=1a a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194446): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194448): arch=c000003e syscall=14 success=yes exit=0 a0=0 a1=7ffdac6fe9a0 a2=7ffdac6fe920 a3=8 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194447): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.394:194449): arch=c000003e syscall=13 success=yes exit=0 a0=a a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194449): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.395:194450): arch=c000003e syscall=13 success=yes exit=0 a0=c a1=7ffd42eb1590 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.395:194450): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.395:194451): arch=c000003e syscall=13 success=yes exit=0 a0=2 a1=7ffd42eb14a0 a2=7ffd42eb1540 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.395:194451): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.395:194452): arch=c000003e syscall=13 success=yes exit=0 a0=3 a1=7ffd42eb14a0 a2=7ffd42eb1540 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.394:194448): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.395:194453): arch=c000003e syscall=14 success=yes exit=0 a0=2 a1=7ffdac6fe920 a2=0 a3=8 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.395:194452): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.395:194454): arch=c000003e syscall=13 success=yes exit=0 a0=f a1=7ffd42eb14a0 a2=7ffd42eb1540 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.395:194453): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.395:194454): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.395:194456): arch=c000003e syscall=13 success=yes exit=0 a0=11 a1=7ffd42eb14a0 a2=7ffd42eb1540 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="bash" exe="/usr/bin/bash" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.395:194456): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.395:194455): arch=c000003e syscall=228 success=yes exit=0 a0=7 a1=7ffdac6fe9c0 a2=564201867510 a3=8 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.395:194455): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.395:194457): arch=c000003e syscall=1 success=yes exit=52 a0=3 a1=564201869ecc a2=34 a3=8 items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.395:194457): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.395:194458): arch=c000003e syscall=228 success=yes exit=0 a0=7 a1=7ffdac6fe940 a2=564201867510 a3=a items=0 ppid=1271 pid=1281 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.395:194458): proctitle=737368643A206275726E205B707269765D
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.395:194459): arch=c000003e syscall=59 success=yes exit=0 a0=564bb1bed930 a1=564bb1c5ea70 a2=564bb1ba9940 a3=564bb1c5ea60 items=2 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=EXECVE msg=audit(1451781471.395:194459): argc=2 a0="adduser" a1="frodo"
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.395:194459): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.395:194459): item=0 name="/sbin/adduser" inode=67499895 dev=fd:00 mode=0100750 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:useradd_exec_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.395:194459): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=67179931 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.395:194459): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.465:194460): arch=c000003e syscall=12 success=yes exit=93890234830848 a0=0 a1=55648560ba00 a2=7ffc382eed18 a3=1 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.465:194460): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.465:194461): arch=c000003e syscall=9 success=yes exit=139684642189312 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.465:194461): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.466:194462): arch=c000003e syscall=21 success=no exit=-2 a0=7f0add5a5e10 a1=4 a2=0 a3=22 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.466:194462): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.466:194462): item=0 name="/etc/ld.so.preload" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.466:194462): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.466:194463): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add5a4761 a1=80000 a2=1 a3=7f0add7aa460 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.466:194463): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.466:194463): item=0 name="/etc/ld.so.cache" inode=67217436 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:ld_so_cache_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.466:194463): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.467:194464): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382ee1a0 a2=7ffc382ee1a0 a3=7f0add7aa460 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.467:194464): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.467:194465): arch=c000003e syscall=9 success=yes exit=139684642148352 a0=0 a1=90d3 a2=1 a3=2 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.467:194465): fd=3 flags=0x2
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.467:194465): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.467:194466): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=90d3 a2=1 a3=2 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.467:194466): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.467:194467): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add7a7640 a1=80000 a2=7f0add7aa148 a3=7f0add7a5a9f items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.467:194467): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.467:194467): item=0 name="/lib64/libaudit.so.1" inode=67217469 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.467:194467): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.467:194468): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382ee330 a2=340 a3=7f0add7a5a9f items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.467:194468): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.467:194469): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382ee1e0 a2=7ffc382ee1e0 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.467:194469): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.467:194470): arch=c000003e syscall=9 success=yes exit=139684637708288 a0=0 a1=226048 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.467:194470): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.467:194470): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.467:194471): arch=c000003e syscall=10 success=yes exit=0 a0=7f0add37d000 a1=1ff000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.467:194471): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.468:194472): arch=c000003e syscall=9 success=yes exit=139684639916032 a0=7f0add57c000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.468:194472): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.468:194472): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.468:194473): arch=c000003e syscall=9 success=yes exit=139684639924224 a0=7f0add57e000 a1=9048 a2=3 a3=32 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.468:194473): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.468:194474): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add7a7698 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.468:194474): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.468:194475): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add7a7b10 a1=80000 a2=7f0add7aa148 a3=7f0add7a1ef9 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.468:194475): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.468:194475): item=0 name="/lib64/libselinux.so.1" inode=67217403 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.468:194475): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.468:194476): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382ee300 a2=340 a3=7f0add7a1ef9 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.468:194476): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.468:194477): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382ee1b0 a2=7ffc382ee1b0 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.468:194477): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.468:194478): arch=c000003e syscall=9 success=yes exit=139684635467776 a0=0 a1=222340 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.468:194478): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.468:194478): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.468:194479): arch=c000003e syscall=10 success=yes exit=0 a0=7f0add15d000 a1=200000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.468:194479): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.468:194480): arch=c000003e syscall=9 success=yes exit=139684637691904 a0=7f0add35d000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.468:194480): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.468:194480): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.469:194481): arch=c000003e syscall=9 success=yes exit=139684637700096 a0=7f0add35f000 a1=1340 a2=3 a3=32 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.469:194481): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.469:194482): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add7a7b68 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.469:194482): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.469:194483): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add7a7fe0 a1=80000 a2=7f0add7aa148 a3=7f0add7a1ed1 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.469:194483): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.469:194483): item=0 name="/lib64/libsemanage.so.1" inode=67499860 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.469:194483): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.469:194484): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382ee2d0 a2=340 a3=7f0add7a1ed1 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.469:194484): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.479:194485): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382ee180 a2=7ffc382ee180 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.479:194485): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.479:194486): arch=c000003e syscall=9 success=yes exit=139684642144256 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.479:194486): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.479:194487): arch=c000003e syscall=9 success=yes exit=139684633133056 a0=0 a1=239a88 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.479:194487): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.479:194487): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.479:194488): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adcf3d000 a1=1ff000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.479:194488): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.479:194489): arch=c000003e syscall=9 success=yes exit=139684635459584 a0=7f0add13c000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.479:194489): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.479:194489): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.481:194490): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add79c040 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.481:194490): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194491): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add79c4c0 a1=80000 a2=7f0add7aa148 a3=7f0add7a5cdc items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.483:194491): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.483:194491): item=0 name="/lib64/libacl.so.1" inode=67217664 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194491): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194492): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382ee2a0 a2=340 a3=7f0add7a5cdc items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194492): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194493): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382ee150 a2=7ffc382ee150 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194493): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194494): arch=c000003e syscall=9 success=yes exit=139684630999040 a0=0 a1=208080 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.483:194494): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194494): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194495): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adcd03000 a1=1ff000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194495): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194496): arch=c000003e syscall=9 success=yes exit=139684633124864 a0=7f0adcf02000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.483:194496): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194496): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194497): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add79c518 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194497): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194498): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add79c990 a1=80000 a2=7f0add7aa148 a3=7f0add7a5ac1 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.483:194498): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.483:194498): item=0 name="/lib64/libattr.so.1" inode=67217654 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194498): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194499): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382ee270 a2=340 a3=7f0add7a5ac1 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194499): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194500): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382ee120 a2=7ffc382ee120 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194500): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194501): arch=c000003e syscall=9 success=yes exit=139684628877312 a0=0 a1=205010 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.483:194501): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194501): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.483:194502): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adcaf9000 a1=200000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.483:194502): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.484:194503): arch=c000003e syscall=9 success=yes exit=139684630990848 a0=7f0adccf9000 a1=1000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.484:194503): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.484:194503): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.484:194504): arch=c000003e syscall=9 success=yes exit=139684630994944 a0=7f0adccfa000 a1=10 a2=3 a3=32 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.484:194504): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.484:194505): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add79c9e8 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.484:194505): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.484:194506): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add79ce60 a1=80000 a2=7f0add7aa148 a3=7f0add7a575f items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.484:194506): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.484:194506): item=0 name="/lib64/libc.so.6" inode=67179938 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.484:194506): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.484:194507): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382ee240 a2=340 a3=7f0add7a575f items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.484:194507): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.484:194508): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382ee0f0 a2=7ffc382ee0f0 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.484:194508): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.484:194509): arch=c000003e syscall=9 success=yes exit=139684642140160 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.484:194509): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.484:194510): arch=c000003e syscall=9 success=yes exit=139684624941056 a0=0 a1=3c0a40 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.484:194510): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.484:194510): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.484:194511): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adc8eb000 a1=200000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.484:194511): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.485:194512): arch=c000003e syscall=9 success=yes exit=139684628836352 a0=7f0adcaeb000 a1=6000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.485:194512): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.485:194512): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.485:194513): arch=c000003e syscall=9 success=yes exit=139684628860928 a0=7f0adcaf1000 a1=3a40 a2=3 a3=32 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.485:194513): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.485:194514): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add79b040 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.485:194514): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.485:194515): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add79b4e0 a1=80000 a2=7f0add7a7b28 a3=7f0add7a2e66 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.485:194515): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.485:194515): item=0 name="/lib64/libpcre.so.1" inode=67217393 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.485:194515): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.485:194516): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382edfe0 a2=340 a3=7f0add7a2e66 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.485:194516): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.485:194517): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382ede90 a2=7ffc382ede90 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.485:194517): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.485:194518): arch=c000003e syscall=9 success=yes exit=139684622385152 a0=0 a1=26f108 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.485:194518): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.485:194518): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.485:194519): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adc533000 a1=1ff000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.485:194519): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.485:194520): arch=c000003e syscall=9 success=yes exit=139684624932864 a0=7f0adc732000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.485:194520): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.485:194520): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.486:194521): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add79b538 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.486:194521): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.486:194522): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add79b9b0 a1=80000 a2=7f0add7a7b28 a3=7f0add7a4ff9 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.486:194522): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.486:194522): item=0 name="/lib64/libdl.so.2" inode=67179944 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.486:194522): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.486:194523): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382edfb0 a2=340 a3=7f0add7a4ff9 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.486:194523): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.486:194524): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382ede60 a2=7ffc382ede60 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.486:194524): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.486:194525): arch=c000003e syscall=9 success=yes exit=139684620271616 a0=0 a1=203110 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.486:194525): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.486:194525): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.486:194526): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adc2c3000 a1=1ff000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.486:194526): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.486:194527): arch=c000003e syscall=9 success=yes exit=139684622376960 a0=7f0adc4c2000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.486:194527): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.486:194527): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.486:194528): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add79ba08 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.486:194528): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.486:194529): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add79bed8 a1=80000 a2=7f0add79c000 a3=7f0add7a1e84 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.486:194529): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.486:194529): item=0 name="/lib64/libsepol.so.1" inode=67215246 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.486:194529): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.487:194530): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382ede10 a2=340 a3=7f0add7a1e84 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.487:194530): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.487:194531): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382edcc0 a2=7ffc382edcc0 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.487:194531): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.487:194532): arch=c000003e syscall=9 success=yes exit=139684642136064 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.487:194532): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.487:194533): arch=c000003e syscall=9 success=yes exit=139684617633792 a0=0 a1=283390 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.487:194533): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.487:194533): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.487:194534): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adc0bd000 a1=200000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.487:194534): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.487:194535): arch=c000003e syscall=9 success=yes exit=139684620259328 a0=7f0adc2bd000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.487:194535): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.487:194535): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.487:194536): arch=c000003e syscall=9 success=yes exit=139684620267520 a0=7f0adc2bf000 a1=390 a2=3 a3=32 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.487:194536): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.487:194537): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add79a040 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.487:194537): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.487:194538): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add79a4b8 a1=80000 a2=7f0add79c000 a3=7f0add7a577c items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.487:194538): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.487:194538): item=0 name="/lib64/libbz2.so.1" inode=67217453 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.487:194538): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.488:194539): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382edde0 a2=340 a3=7f0add7a577c items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.488:194539): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.488:194540): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382edc90 a2=7ffc382edc90 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.488:194540): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.488:194541): arch=c000003e syscall=9 success=yes exit=139684615471104 a0=0 a1=20fc08 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.488:194541): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.488:194541): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.488:194542): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adbe3b000 a1=1ff000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.488:194542): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.488:194543): arch=c000003e syscall=9 success=yes exit=139684617625600 a0=7f0adc03a000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.488:194543): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.488:194543): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.488:194544): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add79a510 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.488:194544): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.488:194545): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add79a988 a1=80000 a2=7f0add79c000 a3=7f0add7a1628 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.488:194545): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.488:194545): item=0 name="/lib64/libustr-1.0.so.1" inode=67499861 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.488:194545): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.488:194546): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382eddb0 a2=340 a3=7f0add7a1628 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.488:194546): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.489:194547): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382edc60 a2=7ffc382edc60 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.489:194547): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.489:194548): arch=c000003e syscall=9 success=yes exit=139684613148672 a0=0 a1=236600 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.489:194548): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.489:194548): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.490:194549): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adbc2b000 a1=1ff000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.490:194549): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.490:194550): arch=c000003e syscall=9 success=yes exit=139684615462912 a0=7f0adbe2a000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.490:194550): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.490:194550): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.491:194551): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add79a9e0 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.491:194551): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.492:194552): arch=c000003e syscall=2 success=yes exit=3 a0=7f0add79af60 a1=80000 a2=7f0add79b4f8 a3=7f0add7a2455 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.492:194552): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.492:194552): item=0 name="/lib64/libpthread.so.0" inode=67179966 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.492:194552): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.492:194553): arch=c000003e syscall=0 success=yes exit=832 a0=3 a1=7ffc382edd80 a2=340 a3=7f0add7a2455 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.492:194553): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.492:194554): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7ffc382edc30 a2=7ffc382edc30 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.492:194554): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.492:194555): arch=c000003e syscall=9 success=yes exit=139684642131968 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.492:194555): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.492:194556): arch=c000003e syscall=9 success=yes exit=139684610932736 a0=0 a1=21c4b0 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.492:194556): fd=3 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.492:194556): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.492:194557): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adb9f0000 a1=1ff000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.492:194557): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.492:194558): arch=c000003e syscall=9 success=yes exit=139684613124096 a0=7f0adbbef000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.492:194558): fd=3 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.492:194558): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.492:194559): arch=c000003e syscall=9 success=yes exit=139684613132288 a0=7f0adbbf1000 a1=34b0 a2=3 a3=32 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.492:194559): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.493:194560): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=7f0add799040 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.493:194560): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.493:194561): arch=c000003e syscall=9 success=yes exit=139684642127872 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.493:194561): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.493:194562): arch=c000003e syscall=9 success=yes exit=139684642119680 a0=0 a1=2000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.493:194562): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.493:194563): arch=c000003e syscall=158 success=yes exit=0 a0=1002 a1=7f0add796800 a2=7f0add798000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.493:194563): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.493:194564): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adcaeb000 a1=4000 a2=1 a3=4 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.493:194564): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.493:194565): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adbbef000 a1=1000 a2=1 a3=7f0adbbefff0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.493:194565): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.493:194566): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adbe2a000 a1=1000 a2=1 a3=7f0adbe2b588 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.493:194566): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.493:194567): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adc03a000 a1=1000 a2=1 a3=7f0adc03afa8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.493:194567): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.494:194568): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adc2bd000 a1=1000 a2=1 a3=7f0adc2bdff0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.494:194568): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.494:194569): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adc4c2000 a1=1000 a2=1 a3=7f0adc4c2ff8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.494:194569): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.494:194570): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adc732000 a1=1000 a2=1 a3=7f0adc732f80 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.494:194570): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.494:194571): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adccf9000 a1=1000 a2=1 a3=7f0adccf9fc8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.494:194571): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.494:194572): arch=c000003e syscall=10 success=yes exit=0 a0=7f0adcf02000 a1=1000 a2=1 a3=7f0adcf02fa8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.494:194572): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.494:194573): arch=c000003e syscall=10 success=yes exit=0 a0=7f0add57c000 a1=1000 a2=1 a3=7f0add57cf98 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.494:194573): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.494:194574): arch=c000003e syscall=10 success=yes exit=0 a0=7f0add35d000 a1=1000 a2=1 a3=7f0add35df60 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.494:194574): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.495:194575): arch=c000003e syscall=10 success=yes exit=0 a0=7f0add13c000 a1=1000 a2=1 a3=7f0add13cfa8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.495:194575): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.495:194576): arch=c000003e syscall=10 success=yes exit=0 a0=55648581e000 a1=2000 a2=1 a3=55648581ffb8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.495:194576): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.495:194577): arch=c000003e syscall=10 success=yes exit=0 a0=7f0add7a8000 a1=1000 a2=1 a3=7f0add7a8fd8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.495:194577): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.495:194578): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add79d000 a1=90d3 a2=def00000000 a3=7f0add7a8fd8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.495:194578): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.495:194579): arch=c000003e syscall=218 success=yes exit=1321 a0=7f0add796ad0 a1=7ffc382eeb38 a2=7f0add796800 a3=7f0add7a8fd8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.495:194579): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.495:194580): arch=c000003e syscall=273 success=yes exit=0 a0=7f0add796ae0 a1=18 a2=7f0add796800 a3=7f0add7a8fd8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.495:194580): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.496:194581): arch=c000003e syscall=13 success=yes exit=0 a0=20 a1=7ffc382ee880 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.496:194581): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.496:194582): arch=c000003e syscall=13 success=yes exit=0 a0=21 a1=7ffc382ee880 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.496:194582): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.496:194583): arch=c000003e syscall=14 success=yes exit=0 a0=1 a1=7ffc382ee9f8 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.496:194583): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.496:194584): arch=c000003e syscall=97 success=yes exit=0 a0=3 a1=7ffc382ee9e0 a2=3f a3=1a items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.496:194584): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.496:194585): arch=c000003e syscall=137 success=yes exit=0 a0=7f0add157762 a1=7ffc382ee9b0 a2=fffffffffff468f2 a3=206d7 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.496:194585): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.496:194585): item=0 name="/sys/fs/selinux" inode=1 dev=00:10 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:security_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.496:194585): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.496:194586): arch=c000003e syscall=137 success=yes exit=0 a0=7f0add157762 a1=7ffc382ee8a0 a2=fffffffffff468f2 a3=206d7 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.496:194586): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.496:194586): item=0 name="/sys/fs/selinux" inode=1 dev=00:10 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:security_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.496:194586): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.497:194587): arch=c000003e syscall=12 success=yes exit=93890234830848 a0=0 a1=7f0adcaefb40 a2=21000 a3=21000 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.497:194587): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.497:194588): arch=c000003e syscall=12 success=yes exit=93890234966016 a0=5564861a6000 a1=7f0adcaefb40 a2=556486185000 a3=21000 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.497:194588): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.497:194589): arch=c000003e syscall=21 success=yes exit=0 a0=7f0add157249 a1=0 a2=7f0add35f1e0 a3=21000 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.497:194589): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.497:194589): item=0 name="/etc/selinux/config" inode=100888462 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:selinux_config_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.497:194589): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.497:194590): arch=c000003e syscall=2 success=yes exit=3 a0=7f0adc8bfe60 a1=80000 a2=0 a3=7f0adcaefba8 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.497:194590): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.497:194590): item=0 name="/usr/lib/locale/locale-archive" inode=34297353 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:locale_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.497:194590): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.497:194591): arch=c000003e syscall=5 success=yes exit=0 a0=3 a1=7f0adcaf09a0 a2=7f0adcaf09a0 a3=7f0adcaefba8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.497:194591): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.497:194592): arch=c000003e syscall=9 success=yes exit=139684500492288 a0=0 a1=6952b40 a2=1 a3=2 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.497:194592): fd=3 flags=0x2
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.497:194592): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.497:194593): arch=c000003e syscall=3 success=yes exit=0 a0=3 a1=6952b40 a2=616f a3=2 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.497:194593): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.497:194594): arch=c000003e syscall=41 success=yes exit=3 a0=10 a1=3 a2=9 a3=7f0adcaefba8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.497:194594): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.497:194595): arch=c000003e syscall=72 success=yes exit=0 a0=3 a1=2 a2=1 a3=7f0adcaefba8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.497:194595): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.497:194596): arch=c000003e syscall=2 success=yes exit=4 a0=5564858203e0 a1=0 a2=1b6 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.497:194596): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.497:194596): item=0 name="/etc/login.defs" inode=67499881 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.497:194596): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.497:194597): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7ffc382ee3e0 a2=7ffc382ee3e0 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.497:194597): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.498:194598): arch=c000003e syscall=9 success=yes exit=139684642185216 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.498:194598): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.498:194599): arch=c000003e syscall=0 success=yes exit=2028 a0=4 a1=7f0add7a6000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.498:194599): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.498:194600): arch=c000003e syscall=0 success=yes exit=0 a0=4 a1=7f0add7a6000 a2=1000 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.498:194600): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.498:194601): arch=c000003e syscall=3 success=yes exit=0 a0=4 a1=1 a2=556486186130 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.498:194601): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.498:194602): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add7a6000 a1=1000 a2=0 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.498:194602): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.498:194603): arch=c000003e syscall=2 success=yes exit=4 a0=7f0adc8bc6f2 a1=0 a2=ea60 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.498:194603): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.498:194603): item=0 name="/proc/sys/kernel/ngroups_max" inode=17243 dev=00:04 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:sysctl_kernel_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.498:194603): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.498:194604): arch=c000003e syscall=0 success=yes exit=6 a0=4 a1=7ffc382ee980 a2=1f a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.498:194604): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.498:194605): arch=c000003e syscall=3 success=yes exit=0 a0=4 a1=7ffc382ee980 a2=6 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.498:194605): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.498:194606): arch=c000003e syscall=9 success=yes exit=139684641591296 a0=0 a1=81000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.498:194606): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.498:194607): arch=c000003e syscall=21 success=yes exit=0 a0=556485821f60 a1=0 a2=7f0add715010 a3=22 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.498:194607): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.498:194607): item=0 name="/etc/shadow" inode=67856639 dev=fd:00 mode=0100000 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shadow_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.498:194607): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.498:194608): arch=c000003e syscall=21 success=yes exit=0 a0=556485821ac0 a1=0 a2=7f0add715010 a3=22 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.498:194608): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.498:194608): item=0 name="/etc/gshadow" inode=67856644 dev=fd:00 mode=0100000 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shadow_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.498:194608): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.499:194609): arch=c000003e syscall=21 success=no exit=-2 a0=556485821620 a1=0 a2=7f0add715010 a3=22 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.499:194609): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.499:194609): item=0 name="/etc/subuid" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.499:194609): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.499:194610): arch=c000003e syscall=21 success=no exit=-2 a0=5564858211e0 a1=0 a2=0 a3=22 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.499:194610): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.499:194610): item=0 name="/etc/subgid" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.499:194610): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.499:194611): arch=c000003e syscall=2 success=yes exit=4 a0=556485618b31 a1=0 a2=1b6 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.499:194611): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.499:194611): item=0 name="/etc/default/useradd" inode=186424 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.499:194611): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.534:194612): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7ffc382ee3f0 a2=7ffc382ee3f0 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.534:194612): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.534:194613): arch=c000003e syscall=9 success=yes exit=139684642185216 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.534:194613): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.534:194614): arch=c000003e syscall=0 success=yes exit=119 a0=4 a1=7f0add7a6000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.534:194614): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.555:194615): arch=c000003e syscall=41 success=yes exit=5 a0=1 a1=80801 a2=0 a3=6 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.555:194615): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.555:194616): arch=c000003e syscall=42 success=no exit=-2 a0=5 a1=7ffc382edc80 a2=6e a3=6 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.555:194616): saddr=01002F7661722F72756E2F6E7363642F736F636B657400005665885600000000B2CC05200000000000000000000000000000000000000000000000000000000080DD2E38FC7F0000048759DD0A7F000000000000000000002BC29DDB0A7F0000009079DD0A7F0000D50159DD0A7F
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.555:194616): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.555:194616): item=0 name="/var/run/nscd/socket" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.555:194616): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.555:194617): arch=c000003e syscall=3 success=yes exit=0 a0=5 a1=7ffc382edc80 a2=6e a3=6 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.555:194617): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.555:194618): arch=c000003e syscall=41 success=yes exit=5 a0=1 a1=80801 a2=0 a3=5564861864a0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.555:194618): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.555:194619): arch=c000003e syscall=42 success=no exit=-2 a0=5 a1=7ffc382ede00 a2=6e a3=5564861864a0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.555:194619): saddr=01002F7661722F72756E2F6E7363642F736F636B657400001C000000000000001C0000000000000010000000000000000100000005000000000000000000000000000000000000000000000000000000A072010000000000A0720100000000000000200000000000010000000600
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.555:194619): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.555:194619): item=0 name="/var/run/nscd/socket" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.555:194619): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.555:194620): arch=c000003e syscall=3 success=yes exit=0 a0=5 a1=7ffc382ede00 a2=6e a3=5564861864a0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.555:194620): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.555:194621): arch=c000003e syscall=2 success=yes exit=5 a0=7f0adc8bdab8 a1=80000 a2=1b6 a3=80000 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.555:194621): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.555:194621): item=0 name="/etc/nsswitch.conf" inode=67151268 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.555:194621): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.556:194622): arch=c000003e syscall=5 success=yes exit=0 a0=5 a1=7ffc382ee270 a2=7ffc382ee270 a3=7f0adcaefc08 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.556:194622): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.556:194623): arch=c000003e syscall=9 success=yes exit=139684642181120 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.556:194623): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.556:194624): arch=c000003e syscall=0 success=yes exit=1718 a0=5 a1=7f0add7a5000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.556:194624): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.556:194625): arch=c000003e syscall=0 success=yes exit=0 a0=5 a1=7f0add7a5000 a2=1000 a3=7f0adcaefbc8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.556:194625): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.556:194626): arch=c000003e syscall=3 success=yes exit=0 a0=5 a1=0 a2=0 a3=7f0adcaefbc8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.556:194626): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.556:194627): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add7a5000 a1=1000 a2=0 a3=7f0adcaefbc8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.556:194627): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.556:194628): arch=c000003e syscall=2 success=yes exit=5 a0=7f0add5a4761 a1=80000 a2=1 a3=7f0add7aa460 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.556:194628): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.556:194628): item=0 name="/etc/ld.so.cache" inode=67217436 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:ld_so_cache_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.556:194628): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.556:194629): arch=c000003e syscall=5 success=yes exit=0 a0=5 a1=7ffc382ed9e0 a2=7ffc382ed9e0 a3=7f0add7aa460 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.556:194629): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.556:194630): arch=c000003e syscall=9 success=yes exit=139684641550336 a0=0 a1=90d3 a2=1 a3=2 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.556:194630): fd=5 flags=0x2
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.556:194630): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.556:194631): arch=c000003e syscall=3 success=yes exit=0 a0=5 a1=90d3 a2=1 a3=2 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.556:194631): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.556:194632): arch=c000003e syscall=2 success=yes exit=5 a0=556486186650 a1=80000 a2=7f0add79b000 a3=7f0adcaefbb8 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.556:194632): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.556:194632): item=0 name="/lib64/libnss_files.so.2" inode=67179958 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.556:194632): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.557:194633): arch=c000003e syscall=0 success=yes exit=832 a0=5 a1=7ffc382edb70 a2=340 a3=7f0adcaefbb8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.557:194633): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.557:194634): arch=c000003e syscall=5 success=yes exit=0 a0=5 a1=7ffc382eda20 a2=7ffc382eda20 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.557:194634): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.557:194635): arch=c000003e syscall=9 success=yes exit=139684498321408 a0=0 a1=211718 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.557:194635): fd=5 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.557:194635): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.557:194636): arch=c000003e syscall=10 success=yes exit=0 a0=7f0ad4e7e000 a1=1ff000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.557:194636): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.557:194637): arch=c000003e syscall=9 success=yes exit=139684500459520 a0=7f0ad507d000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.557:194637): fd=5 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.557:194637): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.557:194638): arch=c000003e syscall=9 success=yes exit=139684500467712 a0=7f0ad507f000 a1=5718 a2=3 a3=32 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.557:194638): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.557:194639): arch=c000003e syscall=3 success=yes exit=0 a0=5 a1=5564861871f0 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.557:194639): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.557:194640): arch=c000003e syscall=10 success=yes exit=0 a0=7f0ad507d000 a1=1000 a2=1 a3=7f0ad507dff8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.557:194640): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.557:194641): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add70b000 a1=90d3 a2=7ffc382ee0f7 a3=7f0ad507dff8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.557:194641): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.557:194642): arch=c000003e syscall=2 success=yes exit=5 a0=7f0ad4e7b257 a1=80000 a2=1b6 a3=80000 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.557:194642): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.557:194642): item=0 name="/etc/group" inode=67220873 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.557:194642): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.557:194643): arch=c000003e syscall=5 success=yes exit=0 a0=5 a1=7ffc382ee250 a2=7ffc382ee250 a3=1d7 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.557:194643): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.558:194644): arch=c000003e syscall=9 success=yes exit=139684642181120 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.558:194644): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.558:194645): arch=c000003e syscall=0 success=yes exit=702 a0=5 a1=7f0add7a5000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.558:194645): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.558:194646): arch=c000003e syscall=3 success=yes exit=0 a0=5 a1=1 a2=556486187740 a3=474 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.558:194646): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.558:194647): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add7a5000 a1=1000 a2=0 a3=474 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.558:194647): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.558:194648): arch=c000003e syscall=0 success=yes exit=0 a0=4 a1=7f0add7a6000 a2=1000 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.558:194648): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.558:194649): arch=c000003e syscall=3 success=yes exit=0 a0=4 a1=1 a2=556486186130 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.558:194649): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.558:194650): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add7a6000 a1=1000 a2=0 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.558:194650): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.558:194651): arch=c000003e syscall=41 success=yes exit=4 a0=1 a1=80801 a2=0 a3=6 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.558:194651): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.558:194652): arch=c000003e syscall=42 success=no exit=-2 a0=4 a1=7ffc382ee550 a2=6e a3=6 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.558:194652): saddr=01002F7661722F72756E2F6E7363642F736F636B65740000D8BC6085645500000000454154455F4D41494C5F53504F4F4C3D79657300000000757073206966206E6F206D656D626572732065786973742E0000642C000A0000006500000000000000000000000000770000007C00
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.558:194652): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.558:194652): item=0 name="/var/run/nscd/socket" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.558:194652): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.558:194653): arch=c000003e syscall=3 success=yes exit=0 a0=4 a1=7ffc382ee550 a2=6e a3=6 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.558:194653): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.559:194654): arch=c000003e syscall=41 success=yes exit=4 a0=1 a1=80801 a2=0 a3=6 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.559:194654): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.559:194655): arch=c000003e syscall=42 success=no exit=-2 a0=4 a1=7ffc382ee6d0 a2=6e a3=6 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.559:194655): saddr=01002F7661722F72756E2F6E7363642F736F636B657400003600000000000000208822D50A7F00009609000000000000608D0FD50A7F000076FA120000000000020000000A7F000060E72E38FC7F00005B6518866455000060E72E38FC7F00005065188664550000AA8C61856455
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.559:194655): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.559:194655): item=0 name="/var/run/nscd/socket" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.559:194655): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.559:194656): arch=c000003e syscall=3 success=yes exit=0 a0=4 a1=7ffc382ee6d0 a2=6e a3=6 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.559:194656): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.559:194657): arch=c000003e syscall=2 success=yes exit=4 a0=7f0ad4e7b262 a1=80000 a2=1b6 a3=80000 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.559:194657): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.559:194657): item=0 name="/etc/passwd" inode=67932620 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.559:194657): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.559:194658): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7ffc382ee6e0 a2=7ffc382ee6e0 a3=80000 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.559:194658): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.559:194659): arch=c000003e syscall=9 success=yes exit=139684642185216 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.559:194659): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.559:194660): arch=c000003e syscall=0 success=yes exit=1618 a0=4 a1=7f0add7a6000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.559:194660): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.559:194661): arch=c000003e syscall=0 success=yes exit=0 a0=4 a1=7f0add7a6000 a2=1000 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.559:194661): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.559:194662): arch=c000003e syscall=3 success=yes exit=0 a0=4 a1=1 a2=556486186130 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.559:194662): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.559:194663): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add7a6000 a1=1000 a2=0 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.559:194663): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.559:194664): arch=c000003e syscall=2 success=yes exit=4 a0=7f0add5a4761 a1=80000 a2=1 a3=7f0add7aa460 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.559:194664): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.559:194664): item=0 name="/etc/ld.so.cache" inode=67217436 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:ld_so_cache_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.559:194664): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.560:194665): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7ffc382eded0 a2=7ffc382eded0 a3=7f0add7aa460 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.560:194665): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.560:194666): arch=c000003e syscall=9 success=yes exit=139684642148352 a0=0 a1=90d3 a2=1 a3=2 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.560:194666): fd=4 flags=0x2
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.560:194666): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.560:194667): arch=c000003e syscall=3 success=yes exit=0 a0=4 a1=90d3 a2=1 a3=2 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.560:194667): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.560:194668): arch=c000003e syscall=2 success=yes exit=4 a0=556486186070 a1=80000 a2=7f0add79b000 a3=7f0adcaefba8 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.560:194668): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.560:194668): item=0 name="/lib64/libnss_sss.so.2" inode=67352288 dev=fd:00 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:lib_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.560:194668): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.560:194669): arch=c000003e syscall=0 success=yes exit=832 a0=4 a1=7ffc382ee060 a2=340 a3=7f0adcaefba8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.560:194669): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.560:194670): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7ffc382edf10 a2=7ffc382edf10 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.560:194670): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.560:194671): arch=c000003e syscall=9 success=yes exit=139684496187392 a0=0 a1=2082d0 a2=5 a3=802 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.560:194671): fd=4 flags=0x802
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.560:194671): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.560:194672): arch=c000003e syscall=10 success=yes exit=0 a0=7f0ad4c72000 a1=1ff000 a2=0 a3=5 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.560:194672): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.560:194673): arch=c000003e syscall=9 success=yes exit=139684498313216 a0=7f0ad4e71000 a1=2000 a2=3 a3=812 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=MMAP msg=audit(1451781471.560:194673): fd=4 flags=0x812
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.560:194673): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.560:194674): arch=c000003e syscall=3 success=yes exit=0 a0=4 a1=556486187ab0 a2=0 a3=31 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.560:194674): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194675): arch=c000003e syscall=10 success=yes exit=0 a0=7f0ad4e71000 a1=1000 a2=1 a3=7f0ad4e71fd0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194675): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194676): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add79d000 a1=90d3 a2=7ffc382ee5e7 a3=7f0ad4e71fd0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194676): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194677): arch=c000003e syscall=202 success=yes exit=0 a0=7f0ad4e72048 a1=81 a2=7fffffff a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194677): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194678): arch=c000003e syscall=2 success=no exit=-2 a0=556486187f20 a1=80000 a2=7ffc382ee744 a3=7f0adcaefdb8 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.561:194678): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.561:194678): item=0 name="/var/lib/sss/mc/passwd" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194678): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194679): arch=c000003e syscall=202 success=yes exit=0 a0=7f0ad4e720c8 a1=81 a2=7fffffff a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194679): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194680): arch=c000003e syscall=2 success=no exit=-2 a0=556486187f20 a1=80000 a2=7ffc382ee744 a3=556486187f10 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.561:194680): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.561:194680): item=0 name="/var/lib/sss/mc/passwd" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194680): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194681): arch=c000003e syscall=5 success=no exit=-9 a0=ffffffffffffffff a1=7ffc382ee780 a2=7ffc382ee780 a3=556486187f10 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194681): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194682): arch=c000003e syscall=41 success=yes exit=4 a0=1 a1=1 a2=0 a3=556486187f10 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194682): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194683): arch=c000003e syscall=72 success=yes exit=2 a0=4 a1=3 a2=0 a3=556486187f10 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194683): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194684): arch=c000003e syscall=72 success=yes exit=0 a0=4 a1=4 a2=802 a3=556486187f10 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194684): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194685): arch=c000003e syscall=72 success=yes exit=0 a0=4 a1=1 a2=0 a3=556486187f10 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194685): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.561:194686): arch=c000003e syscall=72 success=yes exit=0 a0=4 a1=2 a2=1 a3=556486187f10 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.561:194686): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.562:194687): arch=c000003e syscall=42 success=no exit=-2 a0=4 a1=7ffc382ee710 a2=6e a3=556486187f10 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.562:194687): saddr=01002F7661722F6C69622F7373732F70697065732F6E73730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.562:194687): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.562:194687): item=0 name="/var/lib/sss/pipes/nss" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.562:194687): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.562:194688): arch=c000003e syscall=3 success=yes exit=0 a0=4 a1=7ffc382ee710 a2=0 a3=556486187f10 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.562:194688): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.562:194689): arch=c000003e syscall=2 success=yes exit=4 a0=7f0ad4e7b257 a1=80000 a2=1b6 a3=80000 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.562:194689): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.562:194689): item=0 name="/etc/group" inode=67220873 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.562:194689): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.562:194690): arch=c000003e syscall=5 success=yes exit=0 a0=4 a1=7ffc382ee6e0 a2=7ffc382ee6e0 a3=80000 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.562:194690): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.562:194691): arch=c000003e syscall=9 success=yes exit=139684642185216 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.562:194691): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.562:194692): arch=c000003e syscall=0 success=yes exit=702 a0=4 a1=7f0add7a6000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.562:194692): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.562:194693): arch=c000003e syscall=0 success=yes exit=0 a0=4 a1=7f0add7a6000 a2=1000 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.562:194693): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.562:194694): arch=c000003e syscall=3 success=yes exit=0 a0=4 a1=1 a2=556486188410 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.562:194694): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.562:194695): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add7a6000 a1=1000 a2=0 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.562:194695): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.562:194696): arch=c000003e syscall=2 success=no exit=-2 a0=5564861883d0 a1=80000 a2=7ffc382ee734 a3=7f0adcaefba8 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.562:194696): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.562:194696): item=0 name="/var/lib/sss/mc/group" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.562:194696): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.563:194697): arch=c000003e syscall=2 success=no exit=-2 a0=5564861883d0 a1=80000 a2=7ffc382ee734 a3=5564861883c0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.563:194697): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.563:194697): item=0 name="/var/lib/sss/mc/group" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.563:194697): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.563:194698): arch=c000003e syscall=41 success=yes exit=4 a0=1 a1=1 a2=0 a3=5564861883c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.563:194698): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.563:194699): arch=c000003e syscall=72 success=yes exit=2 a0=4 a1=3 a2=0 a3=5564861883c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.563:194699): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.563:194700): arch=c000003e syscall=72 success=yes exit=0 a0=4 a1=4 a2=802 a3=5564861883c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.563:194700): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.563:194701): arch=c000003e syscall=72 success=yes exit=0 a0=4 a1=1 a2=0 a3=5564861883c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.563:194701): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.563:194702): arch=c000003e syscall=72 success=yes exit=0 a0=4 a1=2 a2=1 a3=5564861883c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.563:194702): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.563:194703): arch=c000003e syscall=42 success=no exit=-2 a0=4 a1=7ffc382ee700 a2=6e a3=5564861883c0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.563:194703): saddr=01002F7661722F6C69622F7373732F70697065732F6E73730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.563:194703): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.563:194703): item=0 name="/var/lib/sss/pipes/nss" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.563:194703): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.564:194704): arch=c000003e syscall=3 success=yes exit=0 a0=4 a1=7ffc382ee700 a2=0 a3=5564861883c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.564:194704): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.564:194705): arch=c000003e syscall=2 success=yes exit=4 a0=7f0adc8bd2e5 a1=80041 a2=180 a3=5564861883c0 items=2 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.564:194705): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.564:194705): item=0 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.564:194705): item=1 name="/etc/.pwd.lock" inode=67499968 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.564:194705): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.564:194706): arch=c000003e syscall=13 success=yes exit=0 a0=e a1=7ffc382ee5c0 a2=7ffc382ee660 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.564:194706): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.564:194707): arch=c000003e syscall=14 success=yes exit=0 a0=1 a1=7ffc382ee7b0 a2=7ffc382ee730 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.564:194707): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.564:194708): arch=c000003e syscall=37 success=yes exit=0 a0=f a1=7ffc382ee7b0 a2=7ffc382ee730 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.564:194708): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.564:194709): arch=c000003e syscall=72 success=yes exit=0 a0=4 a1=7 a2=7ffc382ee710 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.564:194709): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.564:194710): arch=c000003e syscall=37 success=yes exit=15 a0=0 a1=7 a2=7ffc382ee710 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.564:194710): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.564:194711): arch=c000003e syscall=14 success=yes exit=0 a0=2 a1=7ffc382ee730 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.564:194711): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.565:194712): arch=c000003e syscall=13 success=yes exit=0 a0=e a1=7ffc382ee5c0 a2=0 a3=8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.565:194712): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451786831.916:194713): arch=c000003e syscall=7 success=yes exit=1 a0=7f0ebc0008e0 a1=2 a2=ffffffff a3=561cf096d320 items=0 ppid=1 pid=870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gmain" exe="/usr/sbin/NetworkManager" subj=system_u:system_r:NetworkManager_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451786831.916:194713): proctitle=2F7573722F7362696E2F4E6574776F726B4D616E61676572002D2D6E6F2D6461656D6F6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.565:194714): arch=c000003e syscall=0 success=no exit=-11 a0=4 a1=7f0ec1be0c40 a2=10 a3=561cf096d320 items=0 ppid=1 pid=870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gmain" exe="/usr/sbin/NetworkManager" subj=system_u:system_r:NetworkManager_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.565:194714): proctitle=2F7573722F7362696E2F4E6574776F726B4D616E61676572002D2D6E6F2D6461656D6F6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.565:194715): arch=c000003e syscall=1 success=yes exit=8 a0=4 a1=7f0ec1be0c20 a2=8 a3=20 items=0 ppid=1 pid=870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gmain" exe="/usr/sbin/NetworkManager" subj=system_u:system_r:NetworkManager_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.565:194715): proctitle=2F7573722F7362696E2F4E6574776F726B4D616E61676572002D2D6E6F2D6461656D6F6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.566:194716): arch=c000003e syscall=0 success=yes exit=32 a0=b a1=7f0ec1bdfc20 a2=1000 a3=ffffffffff7ff000 items=0 ppid=1 pid=870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gmain" exe="/usr/sbin/NetworkManager" subj=system_u:system_r:NetworkManager_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.566:194716): proctitle=2F7573722F7362696E2F4E6574776F726B4D616E61676572002D2D6E6F2D6461656D6F6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.566:194717): arch=c000003e syscall=1 success=yes exit=8 a0=4 a1=7f0ec1bdfbb0 a2=8 a3=20 items=0 ppid=1 pid=870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gmain" exe="/usr/sbin/NetworkManager" subj=system_u:system_r:NetworkManager_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.566:194717): proctitle=2F7573722F7362696E2F4E6574776F726B4D616E61676572002D2D6E6F2D6461656D6F6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.566:194718): arch=c000003e syscall=1 success=yes exit=8 a0=4 a1=7f0ec1be0c20 a2=8 a3=20 items=0 ppid=1 pid=870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gmain" exe="/usr/sbin/NetworkManager" subj=system_u:system_r:NetworkManager_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.566:194718): proctitle=2F7573722F7362696E2F4E6574776F726B4D616E61676572002D2D6E6F2D6461656D6F6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.566:194719): arch=c000003e syscall=7 success=yes exit=1 a0=7f0ebc0008e0 a1=2 a2=64 a3=561cf0972c40 items=0 ppid=1 pid=870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gmain" exe="/usr/sbin/NetworkManager" subj=system_u:system_r:NetworkManager_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.566:194719): proctitle=2F7573722F7362696E2F4E6574776F726B4D616E61676572002D2D6E6F2D6461656D6F6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.566:194720): arch=c000003e syscall=7 success=yes exit=1 a0=7f0ebc0008e0 a1=2 a2=64 a3=561cf0972c40 items=0 ppid=1 pid=870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gmain" exe="/usr/sbin/NetworkManager" subj=system_u:system_r:NetworkManager_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.566:194720): proctitle=2F7573722F7362696E2F4E6574776F726B4D616E61676572002D2D6E6F2D6461656D6F6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.566:194721): arch=c000003e syscall=0 success=yes exit=8 a0=4 a1=7f0ec1be0c40 a2=10 a3=561cf0972c40 items=0 ppid=1 pid=870 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="gmain" exe="/usr/sbin/NetworkManager" subj=system_u:system_r:NetworkManager_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.566:194721): proctitle=2F7573722F7362696E2F4E6574776F726B4D616E61676572002D2D6E6F2D6461656D6F6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.565:194722): arch=c000003e syscall=2 success=yes exit=5 a0=7ffc382ee150 a1=241 a2=180 a3=b items=2 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.565:194722): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.565:194722): item=0 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.565:194722): item=1 name="/etc/passwd.1321" inode=67151278 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=CREATE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.565:194722): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.566:194723): arch=c000003e syscall=1 success=yes exit=5 a0=5 a1=7ffc382ee130 a2=5 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.566:194723): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.566:194724): arch=c000003e syscall=3 success=yes exit=0 a0=5 a1=7ffc382ee130 a2=5 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.566:194724): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.566:194725): arch=c000003e syscall=86 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee550 a2=5 a3=0 items=3 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.566:194725): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.566:194725): item=0 name="/etc/passwd.1321" inode=67151278 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.566:194725): item=1 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.566:194725): item=2 name="/etc/passwd.lock" inode=67151278 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=CREATE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.566:194725): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.570:194726): arch=c000003e syscall=4 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee0a0 a2=7ffc382ee0a0 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.570:194726): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.570:194726): item=0 name="/etc/passwd.1321" inode=67151278 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.570:194726): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.571:194727): arch=c000003e syscall=87 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee0a0 a2=7ffc382ee0a0 a3=0 items=2 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.571:194727): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.571:194727): item=0 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.571:194727): item=1 name="/etc/passwd.1321" inode=67151278 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=DELETE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.571:194727): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.571:194728): arch=c000003e syscall=2 success=yes exit=5 a0=556485820d40 a1=20902 a2=c1770000 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.571:194728): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.571:194728): item=0 name="/etc/passwd" inode=67932620 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.571:194728): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.571:194729): arch=c000003e syscall=72 success=yes exit=165890 a0=5 a1=3 a2=c1770000 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.571:194729): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.571:194730): arch=c000003e syscall=72 success=yes exit=0 a0=5 a1=2 a2=1 a3=7f0adcaefdb8 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.571:194730): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.571:194731): arch=c000003e syscall=5 success=yes exit=0 a0=5 a1=7ffc382ee7f0 a2=7ffc382ee7f0 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.571:194731): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.571:194732): arch=c000003e syscall=9 success=yes exit=139684642185216 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.571:194732): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.572:194733): arch=c000003e syscall=0 success=yes exit=1618 a0=5 a1=7f0add7a6000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.572:194733): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.572:194734): arch=c000003e syscall=0 success=yes exit=0 a0=5 a1=7f0add7a6000 a2=1000 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.572:194734): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.572:194735): arch=c000003e syscall=2 success=yes exit=6 a0=7ffc382ee150 a1=241 a2=180 a3=a items=2 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.572:194735): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.572:194735): item=0 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.572:194735): item=1 name="/etc/group.1321" inode=67179932 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=CREATE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.572:194735): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.573:194736): arch=c000003e syscall=1 success=yes exit=5 a0=6 a1=7ffc382ee130 a2=5 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.573:194736): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.574:194737): arch=c000003e syscall=3 success=yes exit=0 a0=6 a1=7ffc382ee130 a2=5 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.574:194737): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.574:194738): arch=c000003e syscall=86 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee550 a2=5 a3=0 items=3 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.574:194738): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.574:194738): item=0 name="/etc/group.1321" inode=67179932 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.574:194738): item=1 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.574:194738): item=2 name="/etc/group.lock" inode=67179932 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=CREATE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.574:194738): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.574:194739): arch=c000003e syscall=4 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee0a0 a2=7ffc382ee0a0 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.574:194739): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.574:194739): item=0 name="/etc/group.1321" inode=67179932 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.574:194739): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.574:194740): arch=c000003e syscall=87 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee0a0 a2=7ffc382ee0a0 a3=0 items=2 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.574:194740): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.574:194740): item=0 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.574:194740): item=1 name="/etc/group.1321" inode=67179932 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=DELETE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.574:194740): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.575:194741): arch=c000003e syscall=2 success=yes exit=6 a0=5564858208a0 a1=20902 a2=c1770000 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.575:194741): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.575:194741): item=0 name="/etc/group" inode=67220873 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.575:194741): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.575:194742): arch=c000003e syscall=72 success=yes exit=165890 a0=6 a1=3 a2=c1770000 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.575:194742): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.575:194743): arch=c000003e syscall=72 success=yes exit=0 a0=6 a1=2 a2=1 a3=556486188610 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.575:194743): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.575:194744): arch=c000003e syscall=5 success=yes exit=0 a0=6 a1=7ffc382ee7c0 a2=7ffc382ee7c0 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.575:194744): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.575:194745): arch=c000003e syscall=9 success=yes exit=139684642181120 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.575:194745): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.575:194746): arch=c000003e syscall=0 success=yes exit=702 a0=6 a1=7f0add7a5000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.575:194746): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.575:194747): arch=c000003e syscall=0 success=yes exit=0 a0=6 a1=7f0add7a5000 a2=1000 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.575:194747): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.575:194748): arch=c000003e syscall=2 success=yes exit=7 a0=7ffc382ee150 a1=241 a2=180 a3=c items=2 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.575:194748): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.575:194748): item=0 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.575:194748): item=1 name="/etc/gshadow.1321" inode=67179939 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=CREATE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.575:194748): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.577:194749): arch=c000003e syscall=1 success=yes exit=5 a0=7 a1=7ffc382ee130 a2=5 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.577:194749): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.577:194750): arch=c000003e syscall=3 success=yes exit=0 a0=7 a1=7ffc382ee130 a2=5 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.577:194750): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.577:194751): arch=c000003e syscall=86 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee550 a2=5 a3=0 items=3 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.577:194751): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.577:194751): item=0 name="/etc/gshadow.1321" inode=67179939 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.577:194751): item=1 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.577:194751): item=2 name="/etc/gshadow.lock" inode=67179939 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=CREATE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.577:194751): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.578:194752): arch=c000003e syscall=4 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee0a0 a2=7ffc382ee0a0 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.578:194752): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.578:194752): item=0 name="/etc/gshadow.1321" inode=67179939 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.578:194752): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.578:194753): arch=c000003e syscall=87 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee0a0 a2=7ffc382ee0a0 a3=0 items=2 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.578:194753): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.578:194753): item=0 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.578:194753): item=1 name="/etc/gshadow.1321" inode=67179939 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=DELETE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.578:194753): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.578:194754): arch=c000003e syscall=2 success=yes exit=7 a0=556485821ac0 a1=20902 a2=c1770000 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.578:194754): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.578:194754): item=0 name="/etc/gshadow" inode=67856644 dev=fd:00 mode=0100000 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shadow_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.578:194754): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.578:194755): arch=c000003e syscall=72 success=yes exit=165890 a0=7 a1=3 a2=c1770000 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.578:194755): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.578:194756): arch=c000003e syscall=72 success=yes exit=0 a0=7 a1=2 a2=1 a3=55648618c020 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.578:194756): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.579:194757): arch=c000003e syscall=5 success=yes exit=0 a0=7 a1=7ffc382ee7c0 a2=7ffc382ee7c0 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.579:194757): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.579:194758): arch=c000003e syscall=9 success=yes exit=139684642177024 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.579:194758): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.579:194759): arch=c000003e syscall=0 success=yes exit=564 a0=7 a1=7f0add7a4000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.579:194759): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.595:194760): arch=c000003e syscall=0 success=yes exit=0 a0=7 a1=7f0add7a4000 a2=1000 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.595:194760): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.595:194761): arch=c000003e syscall=2 success=yes exit=8 a0=7f0ad4e7b262 a1=80000 a2=1b6 a3=80000 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.595:194761): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.595:194761): item=0 name="/etc/passwd" inode=67932620 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.595:194761): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.595:194762): arch=c000003e syscall=5 success=yes exit=0 a0=8 a1=7ffc382ee670 a2=7ffc382ee670 a3=80000 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.595:194762): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.595:194763): arch=c000003e syscall=9 success=yes exit=139684642172928 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.595:194763): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.596:194764): arch=c000003e syscall=0 success=yes exit=1618 a0=8 a1=7f0add7a3000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.596:194764): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.596:194765): arch=c000003e syscall=0 success=yes exit=0 a0=8 a1=7f0add7a3000 a2=1000 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.596:194765): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.596:194766): arch=c000003e syscall=3 success=yes exit=0 a0=8 a1=1 a2=55648618fc80 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.596:194766): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.596:194767): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add7a3000 a1=1000 a2=0 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.596:194767): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.596:194768): arch=c000003e syscall=2 success=no exit=-2 a0=55648618fc60 a1=80000 a2=7ffc382ee6c4 a3=7f0adcaefba8 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.596:194768): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.596:194768): item=0 name="/var/lib/sss/mc/passwd" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.596:194768): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.596:194769): arch=c000003e syscall=2 success=no exit=-2 a0=55648618fc60 a1=80000 a2=7ffc382ee6c4 a3=55648618fc50 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.596:194769): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.596:194769): item=0 name="/var/lib/sss/mc/passwd" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.596:194769): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.596:194770): arch=c000003e syscall=41 success=yes exit=8 a0=1 a1=1 a2=0 a3=55648618fc50 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.596:194770): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.596:194771): arch=c000003e syscall=72 success=yes exit=2 a0=8 a1=3 a2=0 a3=55648618fc50 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.596:194771): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.596:194772): arch=c000003e syscall=72 success=yes exit=0 a0=8 a1=4 a2=802 a3=55648618fc50 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.596:194772): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.596:194773): arch=c000003e syscall=72 success=yes exit=0 a0=8 a1=1 a2=0 a3=55648618fc50 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.596:194773): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194774): arch=c000003e syscall=72 success=yes exit=0 a0=8 a1=2 a2=1 a3=55648618fc50 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194774): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194775): arch=c000003e syscall=42 success=no exit=-2 a0=8 a1=7ffc382ee6a0 a2=6e a3=55648618fc50 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.597:194775): saddr=01002F7661722F6C69622F7373732F70697065732F6E73730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.597:194775): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.597:194775): item=0 name="/var/lib/sss/pipes/nss" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194775): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194776): arch=c000003e syscall=3 success=yes exit=0 a0=8 a1=7ffc382ee6a0 a2=0 a3=55648618fc50 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194776): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194777): arch=c000003e syscall=2 success=yes exit=8 a0=7ffc382ee150 a1=241 a2=180 a3=b items=2 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.597:194777): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.597:194777): item=0 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.597:194777): item=1 name="/etc/shadow.1321" inode=67179943 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=CREATE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194777): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194778): arch=c000003e syscall=1 success=yes exit=5 a0=8 a1=7ffc382ee130 a2=5 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194778): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194779): arch=c000003e syscall=3 success=yes exit=0 a0=8 a1=7ffc382ee130 a2=5 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194779): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194780): arch=c000003e syscall=86 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee550 a2=5 a3=0 items=3 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.597:194780): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.597:194780): item=0 name="/etc/shadow.1321" inode=67179943 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.597:194780): item=1 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.597:194780): item=2 name="/etc/shadow.lock" inode=67179943 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=CREATE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194780): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194781): arch=c000003e syscall=4 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee0a0 a2=7ffc382ee0a0 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.597:194781): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.597:194781): item=0 name="/etc/shadow.1321" inode=67179943 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194781): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194782): arch=c000003e syscall=87 success=yes exit=0 a0=7ffc382ee150 a1=7ffc382ee0a0 a2=7ffc382ee0a0 a3=0 items=2 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.597:194782): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.597:194782): item=0 name="/etc/" inode=67151265 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=PARENT
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.597:194782): item=1 name="/etc/shadow.1321" inode=67179943 dev=fd:00 mode=0100600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:etc_t:s0 nametype=DELETE
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194782): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194783): arch=c000003e syscall=2 success=yes exit=8 a0=556485821f60 a1=20902 a2=c1770000 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.597:194783): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.597:194783): item=0 name="/etc/shadow" inode=67856639 dev=fd:00 mode=0100000 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shadow_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194783): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194784): arch=c000003e syscall=72 success=yes exit=165890 a0=8 a1=3 a2=c1770000 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194784): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.597:194785): arch=c000003e syscall=72 success=yes exit=0 a0=8 a1=2 a2=1 a3=55648618fbe0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.597:194785): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194786): arch=c000003e syscall=5 success=yes exit=0 a0=8 a1=7ffc382ee7f0 a2=7ffc382ee7f0 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194786): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194787): arch=c000003e syscall=9 success=yes exit=139684642172928 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194787): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194788): arch=c000003e syscall=0 success=yes exit=1024 a0=8 a1=7f0add7a3000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194788): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194789): arch=c000003e syscall=0 success=yes exit=0 a0=8 a1=7f0add7a3000 a2=1000 a3=7f0add796800 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194789): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194790): arch=c000003e syscall=2 success=yes exit=9 a0=7f0ad4e7b257 a1=80000 a2=1b6 a3=80000 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.598:194790): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.598:194790): item=0 name="/etc/group" inode=67220873 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:passwd_file_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194790): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194791): arch=c000003e syscall=5 success=yes exit=0 a0=9 a1=7ffc382ee680 a2=7ffc382ee680 a3=80000 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194791): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194792): arch=c000003e syscall=9 success=yes exit=139684642168832 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194792): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194793): arch=c000003e syscall=0 success=yes exit=702 a0=9 a1=7f0add7a2000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194793): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194794): arch=c000003e syscall=0 success=yes exit=0 a0=9 a1=7f0add7a2000 a2=1000 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194794): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194795): arch=c000003e syscall=3 success=yes exit=0 a0=9 a1=1 a2=5564861932f0 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194795): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194796): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add7a2000 a1=1000 a2=0 a3=1999999999999999 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194796): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194797): arch=c000003e syscall=2 success=no exit=-2 a0=5564861932d0 a1=80000 a2=7ffc382ee6c4 a3=7f0adcaefba8 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.598:194797): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.598:194797): item=0 name="/var/lib/sss/mc/group" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194797): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194798): arch=c000003e syscall=2 success=no exit=-2 a0=5564861932d0 a1=80000 a2=7ffc382ee6c4 a3=5564861932c0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.598:194798): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.598:194798): item=0 name="/var/lib/sss/mc/group" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194798): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194799): arch=c000003e syscall=41 success=yes exit=9 a0=1 a1=1 a2=0 a3=5564861932c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194799): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194800): arch=c000003e syscall=72 success=yes exit=2 a0=9 a1=3 a2=0 a3=5564861932c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194800): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194801): arch=c000003e syscall=72 success=yes exit=0 a0=9 a1=4 a2=802 a3=5564861932c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194801): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194802): arch=c000003e syscall=72 success=yes exit=0 a0=9 a1=1 a2=0 a3=5564861932c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194802): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194803): arch=c000003e syscall=72 success=yes exit=0 a0=9 a1=2 a2=1 a3=5564861932c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194803): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194804): arch=c000003e syscall=42 success=no exit=-2 a0=9 a1=7ffc382ee6a0 a2=6e a3=5564861932c0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.598:194804): saddr=01002F7661722F6C69622F7373732F70697065732F6E73730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.598:194804): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.598:194804): item=0 name="/var/lib/sss/pipes/nss" nametype=UNKNOWN
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194804): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194805): arch=c000003e syscall=3 success=yes exit=0 a0=9 a1=7ffc382ee6a0 a2=0 a3=5564861932c0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194805): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194806): arch=c000003e syscall=2 success=yes exit=9 a0=7f0adc8bc50c a1=80000 a2=1b6 a3=80000 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.598:194806): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.598:194806): item=0 name="/etc/localtime" inode=100664282 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:locale_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194806): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194807): arch=c000003e syscall=5 success=yes exit=0 a0=9 a1=7ffc382ee6f0 a2=7ffc382ee6f0 a3=80000 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194807): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194808): arch=c000003e syscall=5 success=yes exit=0 a0=9 a1=7ffc382ee540 a2=7ffc382ee540 a3=80000 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194808): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194809): arch=c000003e syscall=9 success=yes exit=139684642168832 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194809): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194810): arch=c000003e syscall=0 success=yes exit=2223 a0=9 a1=7f0add7a2000 a2=1000 a3=22 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194810): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194811): arch=c000003e syscall=8 success=yes exit=808 a0=9 a1=fffffffffffffa79 a2=1 a3=e items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194811): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194812): arch=c000003e syscall=0 success=yes exit=1415 a0=9 a1=7f0add7a2000 a2=1000 a3=e items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194812): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194813): arch=c000003e syscall=3 success=yes exit=0 a0=9 a1=0 a2=0 a3=e items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194813): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194814): arch=c000003e syscall=11 success=yes exit=0 a0=7f0add7a2000 a1=1000 a2=0 a3=e items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194814): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194815): arch=c000003e syscall=41 success=yes exit=9 a0=1 a1=80002 a2=0 a3=730 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194815): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194816): arch=c000003e syscall=42 success=yes exit=0 a0=9 a1=7f0adcaf21c0 a2=6e a3=730 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.598:194816): saddr=01002F6465762F6C6F6700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.598:194816): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.598:194816): item=0 name="/dev/log" inode=8682 dev=00:14 mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:devlog_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194816): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781463.809:194817): arch=c000003e syscall=232 success=yes exit=1 a0=8 a1=7fff2467bc20 a2=17 a3=ffffffff items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781463.809:194817): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194818): arch=c000003e syscall=228 success=yes exit=0 a0=7 a1=7fff2467bbf0 a2=0 a3=ffffffffff7ff000 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194818): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194819): arch=c000003e syscall=16 success=yes exit=0 a0=3 a1=541b a2=7fff2467babc a3=ffffffffff7ff000 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194819): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194820): arch=c000003e syscall=47 success=yes exit=66 a0=3 a1=7fff2467bae0 a2=40000040 a3=ffffffffff7ff000 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194820): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194821): arch=c000003e syscall=2 success=yes exit=28 a0=7fff2467ad50 a1=80000 a2=1b6 a3=80000 items=1 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.599:194821): cwd="/"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.599:194821): item=0 name="/proc/1321/cgroup" inode=21181 dev=00:04 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194821): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194822): arch=c000003e syscall=5 success=yes exit=0 a0=1c a1=7fff2467abd0 a2=7fff2467abd0 a3=7f129e519840 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194822): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194823): arch=c000003e syscall=9 success=yes exit=139717942345728 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194823): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194824): arch=c000003e syscall=0 success=yes exit=190 a0=1c a1=7f129e528000 a2=400 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194824): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194825): arch=c000003e syscall=3 success=yes exit=0 a0=1c a1=1 a2=55b63b7da460 a3=69737365732f6563 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194825): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194826): arch=c000003e syscall=11 success=yes exit=0 a0=7f129e528000 a1=1000 a2=0 a3=69737365732f6563 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194826): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194827): arch=c000003e syscall=2 success=yes exit=28 a0=7fff2467b340 a1=80000 a2=1b6 a3=80000 items=1 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.599:194827): cwd="/"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.599:194827): item=0 name="/proc/1321/comm" inode=21182 dev=00:04 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194827): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194828): arch=c000003e syscall=5 success=yes exit=0 a0=1c a1=7fff2467a990 a2=7fff2467a990 a3=7f129e519840 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194828): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194829): arch=c000003e syscall=9 success=yes exit=139717942345728 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194829): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194830): arch=c000003e syscall=0 success=yes exit=8 a0=1c a1=7f129e528000 a2=400 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194830): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194831): arch=c000003e syscall=3 success=yes exit=0 a0=1c a1=1 a2=55b63b7da460 a3=55b63b7da970 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194831): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194832): arch=c000003e syscall=11 success=yes exit=0 a0=7f129e528000 a1=1000 a2=0 a3=55b63b7da970 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194832): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.599:194833): arch=c000003e syscall=267 success=yes exit=17 a0=ffffff9c a1=7fff2467b320 a2=55b63b7da860 a3=63 items=1 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.599:194833): cwd="/"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.599:194833): item=0 name="/proc/1321/exe" inode=21183 dev=00:04 mode=0120777 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.599:194833): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194834): arch=c000003e syscall=2 success=yes exit=28 a0=7fff2467b2a0 a1=80000 a2=1b6 a3=80000 items=1 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.600:194834): cwd="/"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.600:194834): item=0 name="/proc/1321/cmdline" inode=21184 dev=00:04 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194834): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194835): arch=c000003e syscall=5 success=yes exit=0 a0=1c a1=7fff2467b190 a2=7fff2467b190 a3=80000 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194835): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194836): arch=c000003e syscall=9 success=yes exit=139717942345728 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194836): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194837): arch=c000003e syscall=0 success=yes exit=14 a0=1c a1=7f129e528000 a2=400 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194837): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194838): arch=c000003e syscall=0 success=yes exit=0 a0=1c a1=7f129e528000 a2=400 a3=55b63b7da5e0 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194838): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194839): arch=c000003e syscall=3 success=yes exit=0 a0=1c a1=1 a2=55b63b7da460 a3=55b63b7da5e0 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194839): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194840): arch=c000003e syscall=11 success=yes exit=0 a0=7f129e528000 a1=1000 a2=0 a3=55b63b7da5e0 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194840): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194841): arch=c000003e syscall=2 success=yes exit=28 a0=7fff2467b2b0 a1=80000 a2=1b6 a3=80000 items=1 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.600:194841): cwd="/"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.600:194841): item=0 name="/proc/1321/status" inode=21185 dev=00:04 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194841): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194842): arch=c000003e syscall=5 success=yes exit=0 a0=1c a1=7fff2467b1d0 a2=7fff2467b1d0 a3=80000 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194842): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194843): arch=c000003e syscall=5 success=yes exit=0 a0=1c a1=7fff2467b090 a2=7fff2467b090 a3=7f129e519840 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194843): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194844): arch=c000003e syscall=9 success=yes exit=139717942345728 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194844): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194845): arch=c000003e syscall=0 success=yes exit=972 a0=1c a1=55b63b7dac50 a2=800 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194845): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194846): arch=c000003e syscall=0 success=yes exit=0 a0=1c a1=55b63b7db01c a2=400 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194846): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194847): arch=c000003e syscall=0 success=yes exit=0 a0=1c a1=55b63b7db01c a2=c00 a3=7f129e519840 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194847): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194848): arch=c000003e syscall=3 success=yes exit=0 a0=1c a1=1 a2=55b63b7da460 a3=7f129e519840 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194848): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194849): arch=c000003e syscall=11 success=yes exit=0 a0=7f129e528000 a1=1000 a2=0 a3=7f129e519840 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194849): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194850): arch=c000003e syscall=2 success=yes exit=28 a0=7fff2467b280 a1=80000 a2=1b6 a3=80000 items=1 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.600:194850): cwd="/"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.600:194850): item=0 name="/proc/1321/sessionid" inode=21186 dev=00:04 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194850): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194851): arch=c000003e syscall=5 success=yes exit=0 a0=1c a1=7fff2467a8d0 a2=7fff2467a8d0 a3=7f129e519840 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194851): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194852): arch=c000003e syscall=9 success=yes exit=139717942345728 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194852): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194853): arch=c000003e syscall=0 success=yes exit=1 a0=1c a1=7f129e528000 a2=400 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194853): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194854): arch=c000003e syscall=0 success=yes exit=0 a0=1c a1=7f129e528000 a2=400 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194854): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194855): arch=c000003e syscall=3 success=yes exit=0 a0=1c a1=1 a2=55b63b7da460 a3=55b63b7da970 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194855): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194856): arch=c000003e syscall=11 success=yes exit=0 a0=7f129e528000 a1=1000 a2=0 a3=55b63b7da970 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194856): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194857): arch=c000003e syscall=2 success=yes exit=28 a0=7fff2467b280 a1=80000 a2=1b6 a3=80000 items=1 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.600:194857): cwd="/"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.600:194857): item=0 name="/proc/1321/loginuid" inode=21187 dev=00:04 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194857): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194858): arch=c000003e syscall=5 success=yes exit=0 a0=1c a1=7fff2467a8d0 a2=7fff2467a8d0 a3=7f129e519840 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194858): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194859): arch=c000003e syscall=9 success=yes exit=139717942345728 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194859): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194860): arch=c000003e syscall=0 success=yes exit=4 a0=1c a1=7f129e528000 a2=400 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194860): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194861): arch=c000003e syscall=0 success=yes exit=0 a0=1c a1=7f129e528000 a2=400 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194861): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194862): arch=c000003e syscall=3 success=yes exit=0 a0=1c a1=1 a2=55b63b7da460 a3=55b63b7da970 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194862): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194863): arch=c000003e syscall=11 success=yes exit=0 a0=7f129e528000 a1=1000 a2=0 a3=55b63b7da970 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194863): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194864): arch=c000003e syscall=2 success=yes exit=28 a0=7fff2467a9f0 a1=80000 a2=1b6 a3=80000 items=1 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.600:194864): cwd="/"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.600:194864): item=0 name="/proc/1321/cgroup" inode=21181 dev=00:04 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194864): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194865): arch=c000003e syscall=5 success=yes exit=0 a0=1c a1=7fff2467a870 a2=7fff2467a870 a3=7f129e519840 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194865): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194866): arch=c000003e syscall=9 success=yes exit=139717942345728 a0=0 a1=1000 a2=3 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194866): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194867): arch=c000003e syscall=0 success=yes exit=190 a0=1c a1=7f129e528000 a2=400 a3=22 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194867): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194868): arch=c000003e syscall=3 success=yes exit=0 a0=1c a1=1 a2=55b63b7da460 a3=69737365732f6563 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194868): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194869): arch=c000003e syscall=11 success=yes exit=0 a0=7f129e528000 a1=1000 a2=0 a3=69737365732f6563 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194869): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.600:194870): arch=c000003e syscall=5 success=yes exit=0 a0=11 a1=55b63b7d2c70 a2=55b63b7d2c70 a3=ffffffffff7ff000 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.600:194870): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781463.808:194871): arch=c000003e syscall=271 success=yes exit=1 a0=7ffcf96cc3e0 a1=1 a2=0 a3=7ffcf96cc3f0 items=0 ppid=1 pid=767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="abrt-dump-journ" exe="/usr/bin/abrt-dump-journal-xorg" subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781463.808:194871): proctitle=2F7573722F62696E2F616272742D64756D702D6A6F75726E616C2D786F7267002D66787444
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194872): arch=c000003e syscall=0 success=yes exit=32 a0=3 a1=7ffcf96cc280 a2=110 a3=ffffffffff7ff000 items=0 ppid=1 pid=767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="abrt-dump-journ" exe="/usr/bin/abrt-dump-journal-xorg" subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194872): proctitle=2F7573722F62696E2F616272742D64756D702D6A6F75726E616C2D786F7267002D66787444
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194873): arch=c000003e syscall=0 success=no exit=-11 a0=3 a1=7ffcf96cc280 a2=110 a3=560957e11440 items=0 ppid=1 pid=767 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="abrt-dump-journ" exe="/usr/bin/abrt-dump-journal-xorg" subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194873): proctitle=2F7573722F62696E2F616272742D64756D702D6A6F75726E616C2D786F7267002D66787444
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781463.808:194874): arch=c000003e syscall=271 success=yes exit=1 a0=7ffecb493800 a1=1 a2=0 a3=7ffecb493810 items=0 ppid=1 pid=766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="abrt-dump-journ" exe="/usr/bin/abrt-dump-journal-oops" subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781463.808:194874): proctitle=2F7573722F62696E2F616272742D64756D702D6A6F75726E616C2D6F6F7073002D66787444
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194875): arch=c000003e syscall=0 success=yes exit=32 a0=3 a1=7ffecb4936a0 a2=110 a3=ffffffffff7ff000 items=0 ppid=1 pid=766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="abrt-dump-journ" exe="/usr/bin/abrt-dump-journal-oops" subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194875): proctitle=2F7573722F62696E2F616272742D64756D702D6A6F75726E616C2D6F6F7073002D66787444
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194876): arch=c000003e syscall=0 success=no exit=-11 a0=3 a1=7ffecb4936a0 a2=110 a3=55cd01855780 items=0 ppid=1 pid=766 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="abrt-dump-journ" exe="/usr/bin/abrt-dump-journal-oops" subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194876): proctitle=2F7573722F62696E2F616272742D64756D702D6A6F75726E616C2D6F6F7073002D66787444
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781463.809:194877): arch=c000003e syscall=7 success=yes exit=1 a0=7fa0c7956cb0 a1=1 a2=ffffffff a3=55c0e766d580 items=0 ppid=1 pid=730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="in:imjournal" exe="/usr/sbin/rsyslogd" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781463.809:194877): proctitle=2F7573722F7362696E2F727379736C6F6764002D6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194878): arch=c000003e syscall=0 success=yes exit=32 a0=9 a1=7fa0c7956ac0 a2=110 a3=ffffffffff7ff000 items=0 ppid=1 pid=730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="in:imjournal" exe="/usr/sbin/rsyslogd" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194878): proctitle=2F7573722F7362696E2F727379736C6F6764002D6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194879): arch=c000003e syscall=0 success=no exit=-11 a0=9 a1=7fa0c7956ac0 a2=110 a3=7fa0c00027e0 items=0 ppid=1 pid=730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="in:imjournal" exe="/usr/sbin/rsyslogd" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194879): proctitle=2F7573722F7362696E2F727379736C6F6764002D6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781463.808:194880): arch=c000003e syscall=202 success=yes exit=0 a0=55c0e766e19c a1=80 a2=6b1b a3=0 items=0 ppid=1 pid=731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=72733A6D61696E20513A526567 exe="/usr/sbin/rsyslogd" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781463.808:194880): proctitle=2F7573722F7362696E2F727379736C6F6764002D6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194881): arch=c000003e syscall=202 success=yes exit=1 a0=55c0e766e19c a1=85 a2=1 a3=1 items=0 ppid=1 pid=730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="in:imjournal" exe="/usr/sbin/rsyslogd" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194881): proctitle=2F7573722F7362696E2F727379736C6F6764002D6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194882): arch=c000003e syscall=202 success=yes exit=0 a0=55c0e766dfb0 a1=80 a2=2 a3=0 items=0 ppid=1 pid=731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=72733A6D61696E20513A526567 exe="/usr/sbin/rsyslogd" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194882): proctitle=2F7573722F7362696E2F727379736C6F6764002D6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194883): arch=c000003e syscall=202 success=yes exit=0 a0=55c0e766dfb0 a1=81 a2=1 a3=0 items=0 ppid=1 pid=731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=72733A6D61696E20513A526567 exe="/usr/sbin/rsyslogd" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194883): proctitle=2F7573722F7362696E2F727379736C6F6764002D6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194884): arch=c000003e syscall=1 success=yes exit=78 a0=4 a1=7fa0b8003a70 a2=4e a3=55c0e60dc2c0 items=0 ppid=1 pid=731 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=72733A6D61696E20513A526567 exe="/usr/sbin/rsyslogd" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194884): proctitle=2F7573722F7362696E2F727379736C6F6764002D6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194885): arch=c000003e syscall=202 success=yes exit=1 a0=55c0e766dfb0 a1=81 a2=1 a3=1 items=0 ppid=1 pid=730 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="in:imjournal" exe="/usr/sbin/rsyslogd" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194885): proctitle=2F7573722F7362696E2F727379736C6F6764002D6E
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194886): arch=c000003e syscall=77 success=yes exit=0 a0=11 a1=2800000 a2=0 a3=7fff2467af00 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194886): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.598:194887): arch=c000003e syscall=44 success=yes exit=66 a0=9 a1=5564861957e0 a2=42 a3=4000 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.598:194887): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194888): arch=c000003e syscall=89 success=yes exit=17 a0=7f0add37add9 a1=7ffc382eb540 a2=1000 a3=556486193480 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.601:194888): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.601:194888): item=0 name="/proc/self/exe" inode=21183 dev=00:04 mode=0120777 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194888): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194889): arch=c000003e syscall=16 success=yes exit=0 a0=0 a1=5401 a2=7ffc382ec2a0 a3=11 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194889): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194890): arch=c000003e syscall=5 success=yes exit=0 a0=0 a1=7ffc382ec350 a2=7ffc382ec350 a3=11 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194890): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194891): arch=c000003e syscall=89 success=yes exit=10 a0=7ffc382ec2f0 a1=7ffc382ec590 a2=1f a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.601:194891): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.601:194891): item=0 name="/proc/self/fd/0" inode=21189 dev=00:04 mode=0120700 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194891): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194892): arch=c000003e syscall=4 success=yes exit=0 a0=7ffc382ec590 a1=7ffc382ec3e0 a2=7ffc382ec3e0 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.601:194892): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.601:194892): item=0 name="/dev/pts/0" inode=3 dev=00:0d mode=020620 ouid=1000 ogid=5 rdev=88:00 obj=unconfined_u:object_r:user_devpts_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194892): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194893): arch=c000003e syscall=6 success=yes exit=0 a0=7ffc382ec590 a1=7ffc382ec4b0 a2=7ffc382ec4b0 a3=0 items=1 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.601:194893): cwd="/home/itsec"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.601:194893): item=0 name="/dev/pts/0" inode=3 dev=00:0d mode=020620 ouid=1000 ogid=5 rdev=88:00 obj=unconfined_u:object_r:user_devpts_t:s0 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194893): proctitle="bash"
+node=auditdtest.a1959.org type=ADD_GROUP msg=audit(1451781471.602:194894): pid=1321 uid=0 auid=1000 ses=1 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=add-group acct="frodo" exe="/usr/sbin/useradd" hostname=? addr=? terminal=pts/0 res=success'
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.602:194895): arch=c000003e syscall=44 success=yes exit=112 a0=3 a1=7ffc382e7ea0 a2=70 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.602:194895): saddr=100000000000000000000000
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.602:194895): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.602:194896): arch=c000003e syscall=7 success=yes exit=1 a0=7ffc382e7e90 a1=1 a2=1f4 a3=0 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.602:194896): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.602:194897): arch=c000003e syscall=45 success=yes exit=36 a0=3 a1=7ffc382ea1d0 a2=231c a3=42 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.602:194897): saddr=100000000000000000000000
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.602:194897): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.602:194898): arch=c000003e syscall=45 success=yes exit=36 a0=3 a1=7ffc382ea1d0 a2=231c a3=40 items=0 ppid=1306 pid=1321 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=1 comm="adduser" exe="/usr/sbin/useradd" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+node=auditdtest.a1959.org type=SOCKADDR msg=audit(1451781471.602:194898): saddr=100000000000000000000000
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.602:194898): proctitle="bash"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.601:194899): arch=c000003e syscall=232 success=yes exit=1 a0=8 a1=7fff2467bc20 a2=17 a3=ffffffff items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.601:194899): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.602:194900): arch=c000003e syscall=228 success=yes exit=0 a0=7 a1=7fff2467bbf0 a2=0 a3=ffffffffff7ff000 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.602:194900): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.602:194901): arch=c000003e syscall=16 success=yes exit=0 a0=3 a1=541b a2=7fff2467babc a3=ffffffffff7ff000 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.602:194901): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.602:194902): arch=c000003e syscall=47 success=yes exit=110 a0=3 a1=7fff2467bae0 a2=40000040 a3=ffffffffff7ff000 items=0 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.602:194902): proctitle="/usr/lib/systemd/systemd-journald"
+node=auditdtest.a1959.org type=SYSCALL msg=audit(1451781471.602:194903): arch=c000003e syscall=2 success=yes exit=28 a0=7fff2467ad20 a1=80000 a2=1b6 a3=80000 items=1 ppid=1 pid=561 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-journal" exe="/usr/lib/systemd/systemd-journald" subj=system_u:system_r:syslogd_t:s0 key=(null)
+node=auditdtest.a1959.org type=CWD msg=audit(1451781471.602:194903): cwd="/"
+node=auditdtest.a1959.org type=PATH msg=audit(1451781471.602:194903): item=0 name="/proc/1321/cgroup" inode=21181 dev=00:04 mode=0100444 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL
+node=auditdtest.a1959.org type=PROCTITLE msg=audit(1451781471.602:194903): proctitle="/usr/lib/systemd/systemd-journald"
[-- Attachment #3: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: Patch to auparse to handle out of order messages 3 of 3
2016-01-06 10:30 Patch to auparse to handle out of order messages 3 of 3 Burn Alting
@ 2016-01-07 22:31 ` Steve Grubb
2016-01-07 23:05 ` Burn Alting
0 siblings, 1 reply; 7+ messages in thread
From: Steve Grubb @ 2016-01-07 22:31 UTC (permalink / raw)
To: linux-audit, burn
On Wednesday, January 06, 2016 09:30:36 PM Burn Alting wrote:
> #3 - modify the standard auparse() test code.
And this patch is applied. Thanks, Burn, for all the patches! This will make
analytical programs much more accurate since interlaced records won't split an
event up any more.
If anyone wants to try out the new audit code from svn please send any
feedback asap. (Same with other bug reports.) I am aiming for a release in the
next 2 days. I just have to finish working on Richard's audit by process name
patch and then its time to release a new package.
-Steve
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Patch to auparse to handle out of order messages 3 of 3
2016-01-07 22:31 ` Steve Grubb
@ 2016-01-07 23:05 ` Burn Alting
2016-01-07 23:44 ` Steve Grubb
0 siblings, 1 reply; 7+ messages in thread
From: Burn Alting @ 2016-01-07 23:05 UTC (permalink / raw)
To: Steve Grubb; +Cc: linux-audit
Steve,
Can I suggest you modify src/ausearch-lol.c:check_events() to add in the
AUDIT_PROCTITLE check (will reduce memory overhead as events will be
flushed faster).
Also can we ask Richard put a comment into the appropriate location in
the kernel code to indicate the link between ausearch/aurport/auparse
depending on AUDIT_PROCTITLE being the last record of an event if
present.
Regards
On Thu, 2016-01-07 at 17:31 -0500, Steve Grubb wrote:
> On Wednesday, January 06, 2016 09:30:36 PM Burn Alting wrote:
> > #3 - modify the standard auparse() test code.
>
> And this patch is applied. Thanks, Burn, for all the patches! This will make
> analytical programs much more accurate since interlaced records won't split an
> event up any more.
>
> If anyone wants to try out the new audit code from svn please send any
> feedback asap. (Same with other bug reports.) I am aiming for a release in the
> next 2 days. I just have to finish working on Richard's audit by process name
> patch and then its time to release a new package.
>
> -Steve
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Patch to auparse to handle out of order messages 3 of 3
2016-01-07 23:05 ` Burn Alting
@ 2016-01-07 23:44 ` Steve Grubb
2016-01-08 3:06 ` Paul Moore
0 siblings, 1 reply; 7+ messages in thread
From: Steve Grubb @ 2016-01-07 23:44 UTC (permalink / raw)
To: burn; +Cc: linux-audit
On Friday, January 08, 2016 10:05:13 AM Burn Alting wrote:
> Steve,
>
> Can I suggest you modify src/ausearch-lol.c:check_events() to add in the
> AUDIT_PROCTITLE check (will reduce memory overhead as events will be
> flushed faster).
OK. Good suggestion. The SVN repo has been updated.
> Also can we ask Richard put a comment into the appropriate location in
> the kernel code to indicate the link between ausearch/aurport/auparse
> depending on AUDIT_PROCTITLE being the last record of an event if
> present.
I'll let them answer.
That said one of the things I want to add in the next development cycle is the
ability to get rid of proctitle records if the admin wants to. They waste a
lot of space. But if they are missing then we have the same performance as we
did before I added this patch.
-Steve
> On Thu, 2016-01-07 at 17:31 -0500, Steve Grubb wrote:
> > On Wednesday, January 06, 2016 09:30:36 PM Burn Alting wrote:
> > > #3 - modify the standard auparse() test code.
> >
> > And this patch is applied. Thanks, Burn, for all the patches! This will
> > make analytical programs much more accurate since interlaced records
> > won't split an event up any more.
> >
> > If anyone wants to try out the new audit code from svn please send any
> > feedback asap. (Same with other bug reports.) I am aiming for a release in
> > the next 2 days. I just have to finish working on Richard's audit by
> > process name patch and then its time to release a new package.
> >
> > -Steve
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Patch to auparse to handle out of order messages 3 of 3
2016-01-07 23:44 ` Steve Grubb
@ 2016-01-08 3:06 ` Paul Moore
2016-01-08 7:27 ` Burn Alting
0 siblings, 1 reply; 7+ messages in thread
From: Paul Moore @ 2016-01-08 3:06 UTC (permalink / raw)
To: Steve Grubb, burn; +Cc: linux-audit
On January 7, 2016 6:47:02 PM Steve Grubb <sgrubb@redhat.com> wrote:
> On Friday, January 08, 2016 10:05:13 AM Burn Alting wrote:
>> Steve,
>>
>> Can I suggest you modify src/ausearch-lol.c:check_events() to add in the
>> AUDIT_PROCTITLE check (will reduce memory overhead as events will be
>> flushed faster).
>
> OK. Good suggestion. The SVN repo has been updated.
>
>
>> Also can we ask Richard put a comment into the appropriate location in
>> the kernel code to indicate the link between ausearch/aurport/auparse
>> depending on AUDIT_PROCTITLE being the last record of an event if
>> present.
>
> I'll let them answer.
Good thing I happened to read this message, I had stopped reading this
thread...
I really dislike comment only patches and I really, really dislike the
fixed format fields/records/etc. that permeates so much of audit these
days. I'll reserve final judgement for if/when any patches are posted, but
just to be clear, I'm not very excited about stuff like this.
> That said one of the things I want to add in the next development cycle is the
> ability to get rid of proctitle records if the admin wants to. They waste a
> lot of space. But if they are missing then we have the same performance as we
> did before I added this patch.
I wouldn't have a problem with that.
>> On Thu, 2016-01-07 at 17:31 -0500, Steve Grubb wrote:
>> > On Wednesday, January 06, 2016 09:30:36 PM Burn Alting wrote:
>> > > #3 - modify the standard auparse() test code.
>> >
>> > And this patch is applied. Thanks, Burn, for all the patches! This will
>> > make analytical programs much more accurate since interlaced records
>> > won't split an event up any more.
>> >
>> > If anyone wants to try out the new audit code from svn please send any
>> > feedback asap. (Same with other bug reports.) I am aiming for a release in
>> > the next 2 days. I just have to finish working on Richard's audit by
>> > process name patch and then its time to release a new package.
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Patch to auparse to handle out of order messages 3 of 3
2016-01-08 3:06 ` Paul Moore
@ 2016-01-08 7:27 ` Burn Alting
2016-01-08 23:22 ` Paul Moore
0 siblings, 1 reply; 7+ messages in thread
From: Burn Alting @ 2016-01-08 7:27 UTC (permalink / raw)
To: Paul Moore; +Cc: linux-audit
On Thu, 2016-01-07 at 22:06 -0500, Paul Moore wrote:
> On January 7, 2016 6:47:02 PM Steve Grubb <sgrubb@redhat.com> wrote:
>
> > On Friday, January 08, 2016 10:05:13 AM Burn Alting wrote:
> >> Steve,
> >>
> >> Can I suggest you modify src/ausearch-lol.c:check_events() to add in the
> >> AUDIT_PROCTITLE check (will reduce memory overhead as events will be
> >> flushed faster).
> >
> > OK. Good suggestion. The SVN repo has been updated.
> >
> >
> >> Also can we ask Richard put a comment into the appropriate location in
> >> the kernel code to indicate the link between ausearch/aurport/auparse
> >> depending on AUDIT_PROCTITLE being the last record of an event if
> >> present.
> >
> > I'll let them answer.
>
> Good thing I happened to read this message, I had stopped reading this
> thread...
>
> I really dislike comment only patches and I really, really dislike the
> fixed format fields/records/etc. that permeates so much of audit these
> days. I'll reserve final judgement for if/when any patches are posted, but
> just to be clear, I'm not very excited about stuff like this.
This is just a request to the kernel audit team, to note that the user
level audit capability is making use of the AUDIT_PROCTITLE record to be
an end of event marker. If you believe this is an unacceptable risk for
downstream processing, then we can take this out and hence withdraw the
request. The alternative is to maintain status quo, and/or optionally
emit the AUDIT_EOE record into the stored audit and be done with it, and
accept the storage cost.
I wholeheartedly agree about the challenges we have with respect to the
current format of the audit events emitted by the kernel. I spend a lot
of effort converting the unstructured, sometimes inconsistently
displayed events into more structured data.
I believe the way forward is to define a more correct, efficient AND
extensible output form for the kernel. On the user space side, we assist
the existing consumers of our audit data (our customers so to speak) by
providing a legacy audispd plugin to take the 'refined' data and format
it into the current 'mash-up'. To assist this interim measure/plugin,
and state that is IS interim, when converting the kernel code to emit a
record, ensure our new method can record the old/legacy format in some
way. The legacy formatting should be able to be compiled out.
Like Paul, I don't like being 'forced' to keep bugs in place within a
data source because those downstream don't want to sustain their data
consumption capability.
>
> > That said one of the things I want to add in the next development cycle is the
> > ability to get rid of proctitle records if the admin wants to. They waste a
> > lot of space. But if they are missing then we have the same performance as we
> > did before I added this patch.
>
> I wouldn't have a problem with that.
>
> >> On Thu, 2016-01-07 at 17:31 -0500, Steve Grubb wrote:
> >> > On Wednesday, January 06, 2016 09:30:36 PM Burn Alting wrote:
> >> > > #3 - modify the standard auparse() test code.
> >> >
> >> > And this patch is applied. Thanks, Burn, for all the patches! This will
> >> > make analytical programs much more accurate since interlaced records
> >> > won't split an event up any more.
> >> >
> >> > If anyone wants to try out the new audit code from svn please send any
> >> > feedback asap. (Same with other bug reports.) I am aiming for a release in
> >> > the next 2 days. I just have to finish working on Richard's audit by
> >> > process name patch and then its time to release a new package.
>
>
> --
> paul moore
> www.paul-moore.com
>
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Patch to auparse to handle out of order messages 3 of 3
2016-01-08 7:27 ` Burn Alting
@ 2016-01-08 23:22 ` Paul Moore
0 siblings, 0 replies; 7+ messages in thread
From: Paul Moore @ 2016-01-08 23:22 UTC (permalink / raw)
To: burn; +Cc: linux-audit
On Fri, Jan 8, 2016 at 2:27 AM, Burn Alting <burn@swtf.dyndns.org> wrote:
> On Thu, 2016-01-07 at 22:06 -0500, Paul Moore wrote:
>> On January 7, 2016 6:47:02 PM Steve Grubb <sgrubb@redhat.com> wrote:
>>
>> > On Friday, January 08, 2016 10:05:13 AM Burn Alting wrote:
>> >> Steve,
>> >>
>> >> Can I suggest you modify src/ausearch-lol.c:check_events() to add in the
>> >> AUDIT_PROCTITLE check (will reduce memory overhead as events will be
>> >> flushed faster).
>> >
>> > OK. Good suggestion. The SVN repo has been updated.
>> >
>> >
>> >> Also can we ask Richard put a comment into the appropriate location in
>> >> the kernel code to indicate the link between ausearch/aurport/auparse
>> >> depending on AUDIT_PROCTITLE being the last record of an event if
>> >> present.
>> >
>> > I'll let them answer.
>>
>> Good thing I happened to read this message, I had stopped reading this
>> thread...
>>
>> I really dislike comment only patches and I really, really dislike the
>> fixed format fields/records/etc. that permeates so much of audit these
>> days. I'll reserve final judgement for if/when any patches are posted, but
>> just to be clear, I'm not very excited about stuff like this.
>
> This is just a request to the kernel audit team, to note that the user
> level audit capability is making use of the AUDIT_PROCTITLE record to be
> an end of event marker. If you believe this is an unacceptable risk for
> downstream processing, then we can take this out and hence withdraw the
> request. The alternative is to maintain status quo, and/or optionally
> emit the AUDIT_EOE record into the stored audit and be done with it, and
> accept the storage cost.
I've already ranted plenty about field ordering so I won't bore you
all again, but you can apply the same rants to record ordering for an
event. I'm begrudgingly going to accept the field ordering in the
current fixed-string format, but that will go away in the future. I'm
much, much less inclined to accept the record ordering, especially
given the idea that there is talk of optionally removing the
AUDIT_PROCTITLE record.
> I wholeheartedly agree about the challenges we have with respect to the
> current format of the audit events emitted by the kernel. I spend a lot
> of effort converting the unstructured, sometimes inconsistently
> displayed events into more structured data.
>
> I believe the way forward is to define a more correct, efficient AND
> extensible output form for the kernel. On the user space side, we assist
> the existing consumers of our audit data (our customers so to speak) by
> providing a legacy audispd plugin to take the 'refined' data and format
> it into the current 'mash-up'. To assist this interim measure/plugin,
> and state that is IS interim, when converting the kernel code to emit a
> record, ensure our new method can record the old/legacy format in some
> way. The legacy formatting should be able to be compiled out.
Due to other projects, it is taking me much longer than anticipated,
but I have no given up on my effort to arrive at a new
kernel/userspace format. I started some work towards removing
audit_log_format() before the holidays, which is the important first
step.
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2016-01-08 23:22 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-01-06 10:30 Patch to auparse to handle out of order messages 3 of 3 Burn Alting
2016-01-07 22:31 ` Steve Grubb
2016-01-07 23:05 ` Burn Alting
2016-01-07 23:44 ` Steve Grubb
2016-01-08 3:06 ` Paul Moore
2016-01-08 7:27 ` Burn Alting
2016-01-08 23:22 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox