Feb 6 07:48:54 prd-ubuntu2004-helm-2c-1g-2971 passwd[712]: password for 'ubuntu' changed by 'root' Feb 6 07:48:54 prd-ubuntu2004-helm-2c-1g-2971 sshd[798]: Server listening on 0.0.0.0 port 22. Feb 6 07:48:54 prd-ubuntu2004-helm-2c-1g-2971 sshd[798]: Server listening on :: port 22. Feb 6 07:48:54 prd-ubuntu2004-helm-2c-1g-2971 systemd-logind[754]: New seat seat0. Feb 6 07:48:54 prd-ubuntu2004-helm-2c-1g-2971 systemd-logind[754]: Watching system buttons on /dev/input/event0 (Power Button) Feb 6 07:48:54 prd-ubuntu2004-helm-2c-1g-2971 systemd-logind[754]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard) Feb 6 07:48:58 prd-ubuntu2004-helm-2c-1g-2971 sshd[1846]: error: kex_exchange_identification: Connection closed by remote host Feb 6 07:49:01 prd-ubuntu2004-helm-2c-1g-2971 CRON[3116]: pam_unix(cron:session): session opened for user root by (uid=0) Feb 6 07:49:01 prd-ubuntu2004-helm-2c-1g-2971 CRON[3116]: pam_unix(cron:session): session closed for user root Feb 6 07:49:04 prd-ubuntu2004-helm-2c-1g-2971 sshd[3905]: Invalid user jenkins from 10.30.104.4 port 53040 Feb 6 07:49:04 prd-ubuntu2004-helm-2c-1g-2971 sshd[3905]: Received disconnect from 10.30.104.4 port 53040:11: Closed due to user request. [preauth] Feb 6 07:49:04 prd-ubuntu2004-helm-2c-1g-2971 sshd[3905]: Disconnected from invalid user jenkins 10.30.104.4 port 53040 [preauth] Feb 6 07:49:06 prd-ubuntu2004-helm-2c-1g-2971 sshd[4634]: Invalid user jenkins from 10.30.104.4 port 53052 Feb 6 07:49:06 prd-ubuntu2004-helm-2c-1g-2971 sshd[4634]: Received disconnect from 10.30.104.4 port 53052:11: Closed due to user request. [preauth] Feb 6 07:49:06 prd-ubuntu2004-helm-2c-1g-2971 sshd[4634]: Disconnected from invalid user jenkins 10.30.104.4 port 53052 [preauth] Feb 6 07:49:08 prd-ubuntu2004-helm-2c-1g-2971 sshd[5327]: Invalid user jenkins from 10.30.104.4 port 53060 Feb 6 07:49:08 prd-ubuntu2004-helm-2c-1g-2971 sshd[5327]: Received disconnect from 10.30.104.4 port 53060:11: Closed due to user request. [preauth] Feb 6 07:49:08 prd-ubuntu2004-helm-2c-1g-2971 sshd[5327]: Disconnected from invalid user jenkins 10.30.104.4 port 53060 [preauth] Feb 6 07:49:10 prd-ubuntu2004-helm-2c-1g-2971 sshd[6054]: Invalid user jenkins from 10.30.104.4 port 53068 Feb 6 07:49:10 prd-ubuntu2004-helm-2c-1g-2971 sshd[6054]: Received disconnect from 10.30.104.4 port 53068:11: Closed due to user request. [preauth] Feb 6 07:49:10 prd-ubuntu2004-helm-2c-1g-2971 sshd[6054]: Disconnected from invalid user jenkins 10.30.104.4 port 53068 [preauth] Feb 6 07:49:12 prd-ubuntu2004-helm-2c-1g-2971 sshd[6864]: Invalid user jenkins from 10.30.104.4 port 53078 Feb 6 07:49:12 prd-ubuntu2004-helm-2c-1g-2971 sshd[6864]: Received disconnect from 10.30.104.4 port 53078:11: Closed due to user request. [preauth] Feb 6 07:49:12 prd-ubuntu2004-helm-2c-1g-2971 sshd[6864]: Disconnected from invalid user jenkins 10.30.104.4 port 53078 [preauth] Feb 6 07:49:15 prd-ubuntu2004-helm-2c-1g-2971 sshd[7813]: Invalid user jenkins from 10.30.104.4 port 53088 Feb 6 07:49:15 prd-ubuntu2004-helm-2c-1g-2971 sshd[7813]: Received disconnect from 10.30.104.4 port 53088:11: Closed due to user request. [preauth] Feb 6 07:49:15 prd-ubuntu2004-helm-2c-1g-2971 sshd[7813]: Disconnected from invalid user jenkins 10.30.104.4 port 53088 [preauth] Feb 6 07:49:17 prd-ubuntu2004-helm-2c-1g-2971 sshd[8635]: Invalid user jenkins from 10.30.104.4 port 53092 Feb 6 07:49:17 prd-ubuntu2004-helm-2c-1g-2971 sshd[8635]: Received disconnect from 10.30.104.4 port 53092:11: Closed due to user request. [preauth] Feb 6 07:49:17 prd-ubuntu2004-helm-2c-1g-2971 sshd[8635]: Disconnected from invalid user jenkins 10.30.104.4 port 53092 [preauth] Feb 6 07:49:19 prd-ubuntu2004-helm-2c-1g-2971 sshd[9137]: Invalid user jenkins from 10.30.104.4 port 53096 Feb 6 07:49:19 prd-ubuntu2004-helm-2c-1g-2971 sshd[9137]: Received disconnect from 10.30.104.4 port 53096:11: Closed due to user request. [preauth] Feb 6 07:49:19 prd-ubuntu2004-helm-2c-1g-2971 sshd[9137]: Disconnected from invalid user jenkins 10.30.104.4 port 53096 [preauth] Feb 6 07:49:21 prd-ubuntu2004-helm-2c-1g-2971 sshd[9435]: Invalid user jenkins from 10.30.104.4 port 53102 Feb 6 07:49:21 prd-ubuntu2004-helm-2c-1g-2971 sshd[9435]: Received disconnect from 10.30.104.4 port 53102:11: Closed due to user request. [preauth] Feb 6 07:49:21 prd-ubuntu2004-helm-2c-1g-2971 sshd[9435]: Disconnected from invalid user jenkins 10.30.104.4 port 53102 [preauth] Feb 6 07:49:23 prd-ubuntu2004-helm-2c-1g-2971 useradd[9951]: new group: name=jenkins, GID=1001 Feb 6 07:49:23 prd-ubuntu2004-helm-2c-1g-2971 useradd[9951]: new user: name=jenkins, UID=1001, GID=1001, home=/home/jenkins, shell=/bin/bash, from=none Feb 6 07:49:23 prd-ubuntu2004-helm-2c-1g-2971 usermod[9999]: add 'jenkins' to group 'docker' Feb 6 07:49:23 prd-ubuntu2004-helm-2c-1g-2971 usermod[9999]: add 'jenkins' to shadow group 'docker' Feb 6 07:49:23 prd-ubuntu2004-helm-2c-1g-2971 sshd[9978]: Received disconnect from 10.30.104.4 port 53106:11: Closed due to user request. [preauth] Feb 6 07:49:23 prd-ubuntu2004-helm-2c-1g-2971 sshd[9978]: Disconnected from authenticating user jenkins 10.30.104.4 port 53106 [preauth] Feb 6 07:49:25 prd-ubuntu2004-helm-2c-1g-2971 sshd[10873]: Accepted publickey for jenkins from 10.30.104.4 port 53110 ssh2: RSA SHA256:V0799BjlU//1ruj1g81rY7MeNIJkwAJ0Kr3lNX3XaN4 Feb 6 07:49:25 prd-ubuntu2004-helm-2c-1g-2971 sshd[10873]: pam_unix(sshd:session): session opened for user jenkins by (uid=0) Feb 6 07:49:25 prd-ubuntu2004-helm-2c-1g-2971 systemd-logind[754]: New session 2 of user jenkins. Feb 6 07:49:25 prd-ubuntu2004-helm-2c-1g-2971 systemd: pam_unix(systemd-user:session): session opened for user jenkins by (uid=0) Feb 6 07:50:02 prd-ubuntu2004-helm-2c-1g-2971 CRON[23191]: pam_unix(cron:session): session opened for user root by (uid=0) Feb 6 07:50:02 prd-ubuntu2004-helm-2c-1g-2971 CRON[23191]: pam_unix(cron:session): session closed for user root Feb 6 07:51:01 prd-ubuntu2004-helm-2c-1g-2971 CRON[28482]: pam_unix(cron:session): session opened for user root by (uid=0) Feb 6 07:51:01 prd-ubuntu2004-helm-2c-1g-2971 CRON[28482]: pam_unix(cron:session): session closed for user root Feb 6 07:51:29 prd-ubuntu2004-helm-2c-1g-2971 sudo: jenkins : TTY=unknown ; PWD=/w/workspace/oom-master-image-verify ; USER=root ; COMMAND=/usr/bin/cp /var/log/auth.log /tmp Feb 6 07:51:29 prd-ubuntu2004-helm-2c-1g-2971 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)