]
op=resume-logging auid=-1 pid=-1 subj=? res=success op=usr1-info auid=-1 pid=-1 subj=? res=failed op=hup-info auid=-1 pid=-1 subj=? res=failed op=error-halt auid=%u pid=%d subj=%s res=failed op=error-halt auid=%u pid=%d res=failed Cannot allocate audit reply, exiting HUP detected, starting config manager op=reconfigure state=no-change auid=-1 pid=-1 subj=? res=failed op=rotate-logs auid=%u pid=%d subj=%s op=resume-logging auid=%u pid=%d subj=%s res=success You must be root or have capabilities to run this program.
Cannot reassign descriptors to /dev/null Cannot change working directory to / Cannot open netlink audit socket op=start ver=%s format=%s kernel=%.56s auid=%u pid=%d uid=%u ses=%u res=success op=start ver=%s format=%s kernel=%.56s auid=%u pid=%d uid=%u ses=%u subj=%s res=success Cannot open out of memory adjuster Unable to adjust out of memory score op=set-enable auid=%u pid=%d uid=%u ses=%u subj=%s res=failed op=set-enable auid=%u pid=%d uid=%u ses=%u res=failed Unable to set initial audit startup state to '%s', exiting op=set-pid auid=%u pid=%d uid=%u ses=%u subj=%s res=failed op=set-pid auid=%u pid=%d uid=%u ses=%u res=failed Unable to set audit pid, exiting op=network-init auid=%u pid=%d uid=%u ses=%u subj=%s res=failed op=network-init auid=%u pid=%d uid=%u ses=%u res=failed Init complete, auditd %s listening for events (startup state %s) op=terminate auid=%u pid=%d subj=%s res=success op=terminate auid=-1 pid=-1 subj=? res=success @@@@@@@p@(@@@@%s.%u UNKNOWN[%d] node=%s type=%s msg=%.*s
type=%s msg=%.*s ? %s=%s /sbin/init No memory rotating logs %s.1 rotate rotate2 reopen No memory shifting logs Next log to use will be %s Audit Disk Space Alert Audit Admin Space Alert fstatfs returned:%d, %s reconfig audit(%lu.%03u:%u) audit(%lu.%03d:%u) yes writing to logs = %s
current log size = %lu
max log size = %lu KB
space left on partition = %s
space_left setting %lu MB
logging suspended = %s
disk error detected = %s
disk full disk write error write flush fsync remote logging suspended resume Audit daemon resumed logging. Couldn't create log file %s (%s) Couldn't open log file %s (%s) Error setting log file CLOEXEC flag (%s) Couldn't change permissions of log file (%s) Couldn't change ownership of log file (%s) Error setting up log descriptor (%s) No memory checking excess logs Log %s removed as it exceeds num_logs parameter node=%s type=DAEMON_ERR op=format-raw msg=NULL res=failed Safe_exec passed NULL for program to execute Audit daemon failed to fork doing safe_exec Audit daemon failed to exec %s Audit daemon failed to fork switching runlevels %s: Audit daemon detected an error writing an event to disk (%s) Audit daemon is suspending logging due to previously mentioned write error The audit daemon is now changing the system to single user mode due to previously mentioned write error The audit daemon is now halting the system due to previously mentioned write error. Unknown disk error action requested Audit daemon has no space left on logging partition Audit daemon rotating log files Audit daemon is suspending logging due to no space left on logging partition. The audit daemon is now changing the system to single user mode due to no space left on logging partition The audit daemon is now halting the system due to no space left on logging partition Unknown disk full action requested Log rotation disabled (num_logs < 2), skipping Couldn't change permissions while rotating log file (%s) Couldn't change ownership while rotating log file (%s) Error rotating logs from %s to %s (%s) Could not reopen a log after rotating. Last known log disappeared (%s) Audit daemon log file is larger than max size Audit daemon is suspending logging due to logfile size. Audit daemon rotating log files with keep option Audit daemon log file is larger than max size and unknown action requested Audit daemon is low on disk space for logging The audit daemon is low on disk space for logging! Please take action
to ensure no loss of service. The audit daemon is very low on disk space for logging! Immediate action
is required to ensure no loss of service. Audit daemon is very low on disk space for logging Audit daemon is suspending logging due to low disk space. The audit daemon is now changing the system to single user mode The audit daemon is now halting the system Audit daemon is low on disk space for logging and unknown action requested config change requested by pid=%d auid=%u subj=%s Cannot change priority in reconfigure (%s) Could not allocate dispatcher memory in reconfigure Could not start dispatcher %s in reconfigure Could not reopen a log after reconfigure %s op=reconfigure state=changed auid=%u pid=%d subj=%s res=success Logging partition free space %lu MB
admin_space_left setting %lu MB
file system space warning sent = %s
admin space warning sent = %s
Error setting up stdout descriptor (%s) No memory for formatting, exiting node=%s type=DAEMON_ERR op=format-enriched msg=NULL res=failed Audit daemon is attempting to resume logging. Could not reopen a log after resume logging , L
d $
l<EjH(krb5_key_file_parser called with: %s krb5_principal_parser called with: %s tcp_listen_queue_parser called with: %s Value %s should only be numbers, or two numbers separated by a dash - line %d Error converting string to a number (%s) - line %d Error - converted number (%ld) is too large - line %d Error - converted range (%ld-%ld) is reversed - line %d Executable path needed for line %d Absolute path needed for %s - line %d Unable to stat %s (%s) - line %d %s is not a regular file - line %d %s is not owned by root - line %d %s permissions should be 0750 or 0755 - line %d disk_error_action_parser called with: %s Illegal option %s for disk_error_action - line %d disk_full_action_parser called with: %s Illegal option %s for disk_full_action - line %d admin_space_left_action_parser called with: %s Email option is specified but %s doesn't seem executable. space_action_parser called with: %s admin_space_left_parser called with: %s Value %c %s should only be numbers or percent - line %d Percentages should be less than 100 - line %d space_left_parser called with: %s dispatch_parser called with: %s The directory name: %s is too short - line %d %s permissions should be 0750 or 0755 log_group_parser called with: %s Numeric group ID conversion error (%s) for %s - line %d
Group ID is non-numeric and unknown (%s) - line %d
log_file_parser called with: %s %s permissions should be 0600 or 0640 audit log is not writable by owner distribute_network_parser called with: %s enable_krb5_parser called with: %s use_libwrap_parser called with: %s verify_email_parser called with: %s max_log_size_action_parser called with: %s name_format_parser called with: %s log_format_parser called with: %s The NOLOG option to log_format is deprecated. Please use the write_logs option. The NOLOG option is overriding the write_logs current setting. write_logs_parser called with: %s local_events_parser called with: %s tcp_client_max_idle_parser called with: %s Value %s should only be numbers - line %d Error - converted number (%s) is too large - line %d tcp_max_per_addr_parser called with: %s Error - converted number (%s) is too small - line %d tcp_listen_port_parser called with: %s priority_boost_parser called with: %s max_log_size_parser called with: %s num_logs_parser called with: %s action_mail_acct_parser called with: %s email: %s is too short, expecting at least 2 characters email: %s has illegal character email: %s should have . after @ validate_email: failed looking up host for %s (%s) validate_email: temporary failure looking up domain for %s Error opening config file (%s) Config file %s doesn't exist, skipping Config file %s opened for parsing Error fstat'ing config file (%s) Error - %s isn't owned by root Error - %s is not a regular file Not processing any more lines in %s Unknown keyword "%s" in line %d of %s Keyword "%s" has invalid option "%s" in line %d of %s Skipping line %d in %s: too long Error - space_left(%lu) must be larger than admin_space_left(%lu) Error - incremental flushing chosen, but 0 selected for freq Warning - freq is non-zero and incremental flushing not selected. Wrong number of arguments for line %d in %s Missing equal sign for line %d in %s Cannot resolve hostname %s (%s) Resolving numeric address for %s name_parser called with: %s ignore Option %s not found - line %d Unable to open %s (%s) Unable to stat %s (%s) %s is not a regular file %s is not owned by root Could not open dir %s (%s) lossy qos_parser called with: %s none flush_parser called with: %s raw num_logs must be 999 or less freq_parser called with: %s %s/auditd.conf /etc/audit/auditd.conf local_events Error - %s is world writable rm Error - fdopen failed (%s) enriched nolog Unable to create %s (%s) Unable to get machine name User defined name missing Resolved node name: %s /usr/lib/sendmail hostname fqd numeric user lossless syslog suspend keep_logs exec single halt incremental incremental_async data write_logs log_format log_group freq num_logs dispatcher name_format disp_qos max_log_file max_log_file_action action_mail_acct verify_email admin_space_left admin_space_left_action disk_full_action disk_error_action priority_boost tcp_listen_port tcp_listen_queue tcp_max_per_addr use_libwrap tcp_client_ports tcp_client_max_idle enable_krb5 krb5_principal krb5_key_file distribute_network Y@ Cconfig_manager init complete op=reconfigure state=no-change auid=%u pid=%d subj=%s res=failed Couldn't create config thread, no config changes Config thread already running, no config changes Audit daemon failed to create pipe while sending email alert Audit daemon failed to fork while sending email alert -f%s -t Error - starting mail To: %s
From: root
Subject: %s
.
Error - %s isn't executable fcntl failed. Cannot get flags (%s) Started dispatcher: %s pid: %u dispatch error reporting limit reached - ending report notification. Failed to set FD_CLOEXEC flag Failed creating disp_pipe Failed to set O_NONBLOCK flag -c exec() failed pipe full dispatch err (%s) event lost GSS error: %s: %s addr=%s port=%u res=success %s:%u encrypting message decrypting message krb5=%s op=dup addr=%s port=%d res=no accepting context displaying name addr=%s port=%d res=success active connections = %u
total connections = %u
IPv4 IPv6 /etc/audit/audit.key %ld Cannot lookup addresses Unable to listen on %ld (%s) KRB5_KTNAME importing name acquiring credentials krb5_init_context krb5 error: %s in %s
krb5_get_default_realm GSS creds for %s acquired client %s idle too long - closing connection
GSS-API error sending token length GSS-API error sending token data client %s socket closed unexpectedly Unable to accept TCP connection op=wrap addr=%s port=%d res=no TCP connection from %s rejected op=port addr=%s port=%d res=no Unable to allocate TCP client data op=alloc addr=%s port=%d res=no GSS-API error reading token length GSS-API error: event length excedes MAX_AUDIT_LENGTH Out of memory allocating token data GSS-API error reading token data TCP session from %s will be closed, error ignored GSS-API Accepted connection from: %s Invalid GSS name from remote client: %s Unauthorized GSS client name: %s (not %s) Unauthorized GSS client realm: %s (not %s) Too many connections from %s - rejected listening for network connections = %s
Cannot create %s listener socket Cannot bind listener socket to port %ld (%s) Listening on TCP port %ld, protocol %s %s is not mode 0400 (it's %#o) - compromised key? %s is not owned by root (it's %d) - compromised key? (libev) system error (libev) epoll_wait LIBEV_FLAGS (libev) select (libev) poll (libev) epoll_create (libev) cannot allocate %ld bytes, aborting. (libev) error creating signal/async pipe ? ư>& .> ? eA @@MbP? ? }Ô%IT .AON8@--g>@vM@`--g?;| % >% ~& +' - ȽP. x. `p
0 pP p p p H P @
(
X
0 P H `x @
@
x
( X @ 8 @p X P P @ x P 8 0( 0 ` ` h p! "X " # `$x % & &p ' (( ) @+ ,` - .( / 0 38 3P `3h 3 p5 ; ; ;8 p]`Q,Wڊc[\orϼA+yB G.N<J/uZ\,X"Dq_ n=M i.*{ 2i\(QGscxق."}po
l"p+*/#h%.SqIu2\tݘ3
@ re̟FVNdTgd1Q\3 pr$e2~--YޢsۜfrJ0A &I~lx8rJQ")o}'8`)˴.|qZ2gk =q*75GѰV]˂.˰s 4R 2H4]߽U7yE{~~Jʻ;9Hc<
/8rT! l+U0')# c=nĠ5 ika>Acx+F`o4%q^Oޣl eWˢ>7G>0uLJ ܳkBPRmDB,YW7&ifc8,izK?܍ZblBeWQLR%(@!1{;
_&wQbũ(-k;c\z o~& U aX@Je̤kq
Ho);6s;Jӑ53 X;n ip?X Vߥ ;-3Kh*EY&1=;`:.+It am8k(
]",; bqçQi[iD3?7m0*rj\ U%kkni&JH$;'
{C4Z $lgܢ%Mz[ z zO=zU l?
i+=n opO",aܦC>\fI MgVQ#Xf!FL4Aw-fah ߈sb/u 䒫*t.(*a{O]
ϒ4T]\/+C^1)A\c [pQOFb!Gr : VݩeIT4T]|\ʾV]:jmaaEhͩ%`_w(- Y %y:4˘ Fϼ<sC
1< L8 #R1!hļHvS,E?HM_7#ӧ ov0Pʸ7HRΛxdOK0ПnwENoR l,4_˺;]c^A2%˺z=$S|n
Ӫk"u1 *;g+6A>g-bڟX7ӚIh\~/\Vc"E='RvRު\b v'QqN:y߆Z:m I YMُW_1BjqR֗ġ;hh&"o5~9C' F X X d
N o [ o `" `" ` j # # ( t B . . ~ @ @ y @ @ L L M M \ \ \ \ H4 | <0 h! h p! p x! x ! ! ! X ! P `! P A P d