type=DAEMON_START msg=audit(1254233331.614:9396): auditd start, ver=1.7.7 format=raw kernel=2.6.18-128.el5 auid=4294967295 pid=2040 subj=system_u:system_r:auditd_t:s0 res=success
type=CONFIG_CHANGE msg=audit(1254233331.719:24): audit_enabled=1 old=0 by auid=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
type=CONFIG_CHANGE msg=audit(1254233331.771:25): audit_backlog_limit=320 old=64 by auid=4294967295 subj=system_u:system_r:auditctl_t:s0 res=1
type=USER_AUTH msg=audit(1254233345.220:26): user pid=2723 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: authentication acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
type=USER_ACCT msg=audit(1254233345.224:27): user pid=2723 uid=0 auid=4294967295 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: accounting acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
type=LOGIN msg=audit(1254233345.239:28): login pid=2723 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=1
type=USER_ROLE_CHANGE msg=audit(1254233345.273:29): user pid=2723 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='pam: default-context=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 selected-context=root:sysadm_r:sysadm_t:s0-s0:c0.c1023: exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
type=USER_START msg=audit(1254233345.275:30): user pid=2723 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: session open acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
type=CRED_ACQ msg=audit(1254233345.278:31): user pid=2723 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='PAM: setcred acct="root" : exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
type=USER_LOGIN msg=audit(1254233345.281:32): user pid=2723 uid=0 auid=0 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=login acct="root" exe="/bin/login" (hostname=?, addr=?, terminal=tty2 res=success)'
type=AVC msg=audit(1254233355.302:33): avc:  denied  { execute_no_trans } for  pid=2834 comm="env" path="/etc/rc.d/init.d/sshd" dev=dm-0 ino=656254 scontext=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:initrc_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1254233355.302:33): arch=40000003 syscall=11 success=yes exit=0 a0=bfacecbc a1=bface648 a2=9048858 a3=5 items=0 ppid=2822 pid=2834 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=tty2 ses=1 comm="sshd" exe="/bin/bash" subj=root:sysadm_r:sysadm_t:s0-s0:c0.c1023 key=(null)