Any idea what causes this message?

[Paul Howarth]

Knute Johnson wrote:
>> Its a mislabeled file.  /var/log/btmp should be labeled faillog_t
>>
>> restorecon -R -v /var/log
>>
>> to fix up everything in /var/log.  btmp is used whenever there is a
>> login failure (I think only failure...)
>>
>> not sure how it got mislabeled (what is supposed to create it, anyone
>> know?  do you remember at some time untaring a bunch of files
>> in /var/log?   or cp'ing in files?  somehow it got created without the
>> 'right' label) but it is occasional because people only occasionally
>> screw up logging in and you get the denial because it is mislabeled.
>> Fix the label and you should be good from now on.
>>
>> -Eric
> 
> Thanks, it was mislabeled.  I don't know how but it's fixed now.

It'll be logrotate.

https://bugzilla.redhat.com/show_bug.cgi?id=427274

Paul.