type=PROCTITLE msg=audit(1510234428.836:1358): proctitle="-bash"
type=SYSCALL msg=audit(1510234428.836:1358): arch=c000003e syscall=59 success=no exit=-13 a0=1d001e0 a1=1cff160 a2=1d13f00 a3=7ffffa7df320 items=0 ppid=21266 pid=21285 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts1 ses=8 comm="bash" exe="/usr/bin/bash" subj=user_u:user_r:user_t:s0 key=(null)
type=AVC msg=audit(1510234428.836:1358): avc:  denied  { execute } for  pid=21285 comm="bash" name="ls" dev="vda1" ino=667 scontext=user_u:user_r:user_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file

type=USER_AUTH msg=audit(1510235398.006:1927): pid=23180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=success acct="root" exe="/usr/sbin/sshd" hostname=? addr=10.43.21.93 terminal=ssh res=success'
type=USER_AUTH msg=audit(1510234423.130:1343): pid=21261 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=pam_unix acct="testuser" exe="/usr/sbin/sshd" hostname=10.43.21.93 addr=10.43.21.93 terminal=ssh res=success'

type=PROCTITLE msg=audit(1510234167.407:1277): proctitle=7365747365626F6F6C002D5000757365725F657865635F636F6E74656E74006F6666
type=SYSCALL msg=audit(1510234167.407:1277): arch=c000003e syscall=1 success=yes exit=2 a0=4 a1=7ffc563cb880 a2=2 a3=7ffc563cb590 items=0 ppid=13073 pid=21125 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=5 comm="setsebool" exe="/usr/sbin/setsebool" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=MAC_CONFIG_CHANGE msg=audit(1510234167.407:1277): bool=user_exec_content val=0 old_val=1 auid=0 ses=5
type=SERVICE_START msg=audit(1510236329.446:2299): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=auditd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

type=CONFIG_CHANGE msg=audit(1510236801.161:2474): lost=0 old=0 auid=0 ses=10 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 res=1

type=CRYPTO_SESSION msg=audit(1510235394.346:1922): pid=23180 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=start direction=from-client cipher=chacha20-poly1305@openssh.com ksize=512 mac=<implicit> pfs=curve25519-sha256@libssh.org spid=23181 suid=74 rport=58662 laddr=172.16.36.72 lport=22  exe="/usr/sbin/sshd" hostname=? addr=10.43.21.93 terminal=? res=success'
type=CRYPTO_KEY_USER msg=audit(1510236517.426:2468): pid=25325 uid=0 auid=0 ses=9 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=destroy kind=server fp=SHA256:f0:94:aa:41:9d:db:ee:e0:04:38:3f:52:84:68:f9:ab:5f:f6:6b:e2:dd:ce:c8:62:d4:18:81:dd:7c:54:58:bb direction=? spid=25325 suid=0  exe="/usr/sbin/sshd" hostname=qeos-72.lab.eng.rdu2.redhat.com addr=? terminal=pts/1 res=success'

type=USER_TTY msg=audit(1510242949.140:2727): pid=26492 uid=0 auid=0 ses=14 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 data="ls"
type=TTY msg=audit(1510242949.140:2726): tty pid=26492 uid=0 auid=0 ses=14 major=136 minor=0 comm="bash" data=737F6C730D

type=USER_LOGIN msg=audit(1511886992.218:88): pid=8810 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="(unknown)" exe="/usr/sbin/sshd" hostname=? addr=10.43.21.39 terminal=ssh res=failed'

type=USER_LOGIN msg=audit(1511887008.793:379): pid=10349 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=10.43.21.39 addr=10.43.21.39 terminal=/dev/pts/0 res=success'

type=FS_RELABEL msg=audit(1502108616.713:1029): pid=29807 uid=0 auid=0 ses=2 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=mass relabel exe="/usr/sbin/setfiles" hostname=? addr=? terminal=? res=success'