Re: [CentOS] Audit logs containing 28756E6B6E6F776E207573657229

2013-06-17 Thread Gregory Machin
Hi. Thank you for the response. All I see in the /var/log/secure that ties up with these logs , based on time stamps are lines like this sshd[5343]: Connection closed by 127.0.0.1 other than that I don't see much else. Thanks G On Wed, Jun 12, 2013 at 9:40 PM, Nicolas Thierry-Mieg

Re: [CentOS] Audit logs containing 28756E6B6E6F776E207573657229

2013-06-12 Thread Nicolas Thierry-Mieg
Gregory Machin wrote: Hi. I'm seeing a lot of entries in /var/log/audit/audit.log acct=28756E6B6E6F776E207573657229 , which apparently means unknown user . Sample from the logs : type=USER_LOGIN msg=audit(1370998250.746:1622709): user pid=16762 uid=0 auid=4294967295 ses=4294967295

[CentOS] Audit logs containing 28756E6B6E6F776E207573657229

2013-06-11 Thread Gregory Machin
Hi. I'm seeing a lot of entries in /var/log/audit/audit.log acct=28756E6B6E6F776E207573657229 , which apparently means unknown user . Sample from the logs : type=USER_LOGIN msg=audit(1370998250.746:1622709): user pid=16762 uid=0 auid=4294967295 ses=4294967295 msg='op=login