May 7 12:44:25 prd-ubuntu1804-docker-8c-8g-11392 passwd[991]: password for 'ubuntu' changed by 'root' May 7 12:44:25 prd-ubuntu1804-docker-8c-8g-11392 systemd-logind[1019]: Watching system buttons on /dev/input/event0 (Power Button) May 7 12:44:25 prd-ubuntu1804-docker-8c-8g-11392 systemd-logind[1019]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard) May 7 12:44:25 prd-ubuntu1804-docker-8c-8g-11392 systemd-logind[1019]: New seat seat0. May 7 12:44:25 prd-ubuntu1804-docker-8c-8g-11392 sshd[1096]: Server listening on 0.0.0.0 port 22. May 7 12:44:25 prd-ubuntu1804-docker-8c-8g-11392 sshd[1096]: Server listening on :: port 22. May 7 12:44:25 prd-ubuntu1804-docker-8c-8g-11392 sshd[1223]: Did not receive identification string from 10.30.104.4 port 36222 May 7 12:44:31 prd-ubuntu1804-docker-8c-8g-11392 sshd[1464]: Invalid user jenkins from 10.30.104.4 port 36228 May 7 12:44:31 prd-ubuntu1804-docker-8c-8g-11392 sshd[1464]: Received disconnect from 10.30.104.4 port 36228:11: Closed due to user request. [preauth] May 7 12:44:31 prd-ubuntu1804-docker-8c-8g-11392 sshd[1464]: Disconnected from invalid user jenkins 10.30.104.4 port 36228 [preauth] May 7 12:44:34 prd-ubuntu1804-docker-8c-8g-11392 sshd[1468]: Invalid user jenkins from 10.30.104.4 port 36230 May 7 12:44:34 prd-ubuntu1804-docker-8c-8g-11392 sshd[1468]: Received disconnect from 10.30.104.4 port 36230:11: Closed due to user request. [preauth] May 7 12:44:34 prd-ubuntu1804-docker-8c-8g-11392 sshd[1468]: Disconnected from invalid user jenkins 10.30.104.4 port 36230 [preauth] May 7 12:44:36 prd-ubuntu1804-docker-8c-8g-11392 sshd[1470]: Invalid user jenkins from 10.30.104.4 port 36234 May 7 12:44:36 prd-ubuntu1804-docker-8c-8g-11392 sshd[1470]: Received disconnect from 10.30.104.4 port 36234:11: Closed due to user request. [preauth] May 7 12:44:36 prd-ubuntu1804-docker-8c-8g-11392 sshd[1470]: Disconnected from invalid user jenkins 10.30.104.4 port 36234 [preauth] May 7 12:44:38 prd-ubuntu1804-docker-8c-8g-11392 sshd[1472]: Invalid user jenkins from 10.30.104.4 port 36236 May 7 12:44:38 prd-ubuntu1804-docker-8c-8g-11392 sshd[1472]: Received disconnect from 10.30.104.4 port 36236:11: Closed due to user request. [preauth] May 7 12:44:38 prd-ubuntu1804-docker-8c-8g-11392 sshd[1472]: Disconnected from invalid user jenkins 10.30.104.4 port 36236 [preauth] May 7 12:44:40 prd-ubuntu1804-docker-8c-8g-11392 sshd[1474]: Invalid user jenkins from 10.30.104.4 port 36238 May 7 12:44:40 prd-ubuntu1804-docker-8c-8g-11392 sshd[1474]: Received disconnect from 10.30.104.4 port 36238:11: Closed due to user request. [preauth] May 7 12:44:40 prd-ubuntu1804-docker-8c-8g-11392 sshd[1474]: Disconnected from invalid user jenkins 10.30.104.4 port 36238 [preauth] May 7 12:44:42 prd-ubuntu1804-docker-8c-8g-11392 sshd[1476]: Invalid user jenkins from 10.30.104.4 port 36254 May 7 12:44:42 prd-ubuntu1804-docker-8c-8g-11392 sshd[1476]: Received disconnect from 10.30.104.4 port 36254:11: Closed due to user request. [preauth] May 7 12:44:42 prd-ubuntu1804-docker-8c-8g-11392 sshd[1476]: Disconnected from invalid user jenkins 10.30.104.4 port 36254 [preauth] May 7 12:44:44 prd-ubuntu1804-docker-8c-8g-11392 sshd[1697]: Invalid user jenkins from 10.30.104.4 port 36260 May 7 12:44:44 prd-ubuntu1804-docker-8c-8g-11392 sshd[1697]: Received disconnect from 10.30.104.4 port 36260:11: Closed due to user request. [preauth] May 7 12:44:44 prd-ubuntu1804-docker-8c-8g-11392 sshd[1697]: Disconnected from invalid user jenkins 10.30.104.4 port 36260 [preauth] May 7 12:44:46 prd-ubuntu1804-docker-8c-8g-11392 sshd[1742]: Invalid user jenkins from 10.30.104.4 port 36268 May 7 12:44:46 prd-ubuntu1804-docker-8c-8g-11392 sshd[1742]: Received disconnect from 10.30.104.4 port 36268:11: Closed due to user request. [preauth] May 7 12:44:46 prd-ubuntu1804-docker-8c-8g-11392 sshd[1742]: Disconnected from invalid user jenkins 10.30.104.4 port 36268 [preauth] May 7 12:44:48 prd-ubuntu1804-docker-8c-8g-11392 sshd[1750]: Invalid user jenkins from 10.30.104.4 port 36272 May 7 12:44:49 prd-ubuntu1804-docker-8c-8g-11392 sshd[1750]: Received disconnect from 10.30.104.4 port 36272:11: Closed due to user request. [preauth] May 7 12:44:49 prd-ubuntu1804-docker-8c-8g-11392 sshd[1750]: Disconnected from invalid user jenkins 10.30.104.4 port 36272 [preauth] May 7 12:44:49 prd-ubuntu1804-docker-8c-8g-11392 useradd[1770]: new group: name=jenkins, GID=1001 May 7 12:44:49 prd-ubuntu1804-docker-8c-8g-11392 useradd[1770]: new user: name=jenkins, UID=1001, GID=1001, home=/home/jenkins, shell=/bin/bash May 7 12:44:49 prd-ubuntu1804-docker-8c-8g-11392 usermod[1777]: add 'jenkins' to group 'docker' May 7 12:44:49 prd-ubuntu1804-docker-8c-8g-11392 usermod[1777]: add 'jenkins' to shadow group 'docker' May 7 12:44:51 prd-ubuntu1804-docker-8c-8g-11392 sshd[1846]: Accepted publickey for jenkins from 10.30.104.4 port 36282 ssh2: RSA SHA256:V0799BjlU//1ruj1g81rY7MeNIJkwAJ0Kr3lNX3XaN4 May 7 12:44:51 prd-ubuntu1804-docker-8c-8g-11392 sshd[1846]: pam_unix(sshd:session): session opened for user jenkins by (uid=0) May 7 12:44:51 prd-ubuntu1804-docker-8c-8g-11392 systemd-logind[1019]: New session 1 of user jenkins. May 7 12:44:51 prd-ubuntu1804-docker-8c-8g-11392 systemd: pam_unix(systemd-user:session): session opened for user jenkins by (uid=0) May 7 12:45:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2096]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:45:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2096]: pam_unix(cron:session): session closed for user root May 7 12:46:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2104]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:46:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2104]: pam_unix(cron:session): session closed for user root May 7 12:47:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2127]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:47:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2127]: pam_unix(cron:session): session closed for user root May 7 12:48:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2131]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:48:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2131]: pam_unix(cron:session): session closed for user root May 7 12:49:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2135]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:49:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2135]: pam_unix(cron:session): session closed for user root May 7 12:50:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2140]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:50:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2140]: pam_unix(cron:session): session closed for user root May 7 12:51:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2144]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:51:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2144]: pam_unix(cron:session): session closed for user root May 7 12:52:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2147]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:52:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2147]: pam_unix(cron:session): session closed for user root May 7 12:53:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2151]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:53:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2151]: pam_unix(cron:session): session closed for user root May 7 12:54:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2154]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:54:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2154]: pam_unix(cron:session): session closed for user root May 7 12:55:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2159]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:55:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2159]: pam_unix(cron:session): session closed for user root May 7 12:56:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2163]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:56:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2163]: pam_unix(cron:session): session closed for user root May 7 12:57:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2168]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:57:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2168]: pam_unix(cron:session): session closed for user root May 7 12:58:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2171]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:58:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2171]: pam_unix(cron:session): session closed for user root May 7 12:59:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2175]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 12:59:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2175]: pam_unix(cron:session): session closed for user root May 7 13:00:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2193]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 13:00:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2193]: pam_unix(cron:session): session closed for user root May 7 13:01:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2198]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 13:01:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2198]: pam_unix(cron:session): session closed for user root May 7 13:02:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2201]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 13:02:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2201]: pam_unix(cron:session): session closed for user root May 7 13:03:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2208]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 13:03:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2208]: pam_unix(cron:session): session closed for user root May 7 13:04:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2239]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 13:04:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[2239]: pam_unix(cron:session): session closed for user root May 7 13:05:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[3011]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 13:05:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[3011]: pam_unix(cron:session): session closed for user root May 7 13:06:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[5893]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 13:06:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[5893]: pam_unix(cron:session): session closed for user root May 7 13:07:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[9674]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 13:07:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[9674]: pam_unix(cron:session): session closed for user root May 7 13:08:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[9844]: pam_unix(cron:session): session opened for user root by (uid=0) May 7 13:08:01 prd-ubuntu1804-docker-8c-8g-11392 CRON[9844]: pam_unix(cron:session): session closed for user root May 7 13:08:46 prd-ubuntu1804-docker-8c-8g-11392 sudo: jenkins : TTY=unknown ; PWD=/w/workspace/integration-xtesting-security-docker-merge-master ; USER=root ; COMMAND=/bin/cp /var/log/auth.log /tmp May 7 13:08:46 prd-ubuntu1804-docker-8c-8g-11392 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)