----
time->Wed Feb 24 00:44:20 2016
type=CONFIG_CHANGE msg=audit(1456296260.392:3012733752): auid=0 ses=612921 op="updated rules" path="/etc/hosts" key=(null) list=4 res=1
----
time->Wed Feb 24 00:44:20 2016
type=PATH msg=audit(1456296260.392:3012733753): item=3 name="/etc/hosts~" inode=133015 dev=fd:01 mode=0100700 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:net_conf_t:s0 objtype=CREATE
type=PATH msg=audit(1456296260.392:3012733753): item=2 name="/etc/hosts" inode=133015 dev=fd:01 mode=0100700 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:net_conf_t:s0 objtype=DELETE
type=PATH msg=audit(1456296260.392:3012733753): item=1 name="/etc/" inode=130309 dev=fd:01 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 objtype=PARENT
type=PATH msg=audit(1456296260.392:3012733753): item=0 name="/etc/" inode=130309 dev=fd:01 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 objtype=PARENT
type=CWD msg=audit(1456296260.392:3012733753):  cwd="/root"
type=SYSCALL msg=audit(1456296260.392:3012733753): arch=c000003e syscall=82 success=yes exit=0 a0=1d5c730 a1=1d82ab0 a2=fffffffffffffea0 a3=7fffcc152380 items=4 ppid=7009 pid=7575 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=612921 comm="vi" exe="/usr/bin/vi" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
----
time->Wed Feb 24 00:44:20 2016
type=CONFIG_CHANGE msg=audit(1456296260.393:3012733754): auid=0 ses=612921 op="updated rules" path="/etc/hosts" key=(null) list=4 res=1
----
time->Wed Feb 24 00:44:20 2016
type=PATH msg=audit(1456296260.393:3012733755): item=1 name="/etc/hosts" inode=133022 dev=fd:01 mode=0100700 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:net_conf_t:s0 objtype=CREATE
type=PATH msg=audit(1456296260.393:3012733755): item=0 name="/etc/" inode=130309 dev=fd:01 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:etc_t:s0 objtype=PARENT
type=CWD msg=audit(1456296260.393:3012733755):  cwd="/root"
type=SYSCALL msg=audit(1456296260.393:3012733755): arch=c000003e syscall=2 success=yes exit=3 a0=1d5c730 a1=241 a2=1c0 a3=0 items=2 ppid=7009 pid=7575 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=612921 comm="vi" exe="/usr/bin/vi" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
----
time->Wed Feb 24 00:44:20 2016
type=PATH msg=audit(1456296260.413:3012733759): item=0 name="/etc/hosts" inode=133022 dev=fd:01 mode=0100700 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:net_conf_t:s0 objtype=NORMAL
type=CWD msg=audit(1456296260.413:3012733759):  cwd="/root"
type=SYSCALL msg=audit(1456296260.413:3012733759): arch=c000003e syscall=188 success=yes exit=0 a0=1d5c730 a1=7fc4923b877e a2=1d81fd0 a3=20 items=1 ppid=7009 pid=7575 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=612921 comm="vi" exe="/usr/bin/vi" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
----
time->Wed Feb 24 00:44:20 2016
type=PATH msg=audit(1456296260.413:3012733761): item=0 name="/etc/hosts" inode=133022 dev=fd:01 mode=0100700 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:net_conf_t:s0 objtype=NORMAL
type=CWD msg=audit(1456296260.413:3012733761):  cwd="/root"
type=SYSCALL msg=audit(1456296260.413:3012733761): arch=c000003e syscall=90 success=yes exit=0 a0=1d5c730 a1=81c0 a2=0 a3=20 items=1 ppid=7009 pid=7575 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=612921 comm="vi" exe="/usr/bin/vi" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
----
time->Wed Feb 24 00:44:20 2016
type=PATH msg=audit(1456296260.414:3012733762): item=0 name="/etc/hosts" inode=133022 dev=fd:01 mode=0100700 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:net_conf_t:s0 objtype=NORMAL
type=CWD msg=audit(1456296260.414:3012733762):  cwd="/root"
type=SYSCALL msg=audit(1456296260.414:3012733762): arch=c000003e syscall=188 success=yes exit=0 a0=1d5c730 a1=7fc491f71ddf a2=1d81c30 a3=1c items=1 ppid=7009 pid=7575 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=612921 comm="vi" exe="/usr/bin/vi" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)