Aug 29 13:19:46 prd-ubuntu1804-docker-8c-16g-42096 passwd[1114]: password for 'ubuntu' changed by 'root'
Aug 29 13:19:46 prd-ubuntu1804-docker-8c-16g-42096 systemd-logind[1164]: Watching system buttons on /dev/input/event0 (Power Button)
Aug 29 13:19:46 prd-ubuntu1804-docker-8c-16g-42096 systemd-logind[1164]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard)
Aug 29 13:19:46 prd-ubuntu1804-docker-8c-16g-42096 systemd-logind[1164]: New seat seat0.
Aug 29 13:19:46 prd-ubuntu1804-docker-8c-16g-42096 sshd[1272]: Server listening on 0.0.0.0 port 22.
Aug 29 13:19:46 prd-ubuntu1804-docker-8c-16g-42096 sshd[1272]: Server listening on :: port 22.
Aug 29 13:19:46 prd-ubuntu1804-docker-8c-16g-42096 sshd[1379]: Did not receive identification string from 10.30.104.4 port 50354
Aug 29 13:19:51 prd-ubuntu1804-docker-8c-16g-42096 sshd[1617]: Invalid user jenkins from 10.30.104.4 port 50360
Aug 29 13:19:51 prd-ubuntu1804-docker-8c-16g-42096 sshd[1617]: Received disconnect from 10.30.104.4 port 50360:11: Closed due to user request. [preauth]
Aug 29 13:19:51 prd-ubuntu1804-docker-8c-16g-42096 sshd[1617]: Disconnected from invalid user jenkins 10.30.104.4 port 50360 [preauth]
Aug 29 13:19:53 prd-ubuntu1804-docker-8c-16g-42096 sshd[1621]: Invalid user jenkins from 10.30.104.4 port 50366
Aug 29 13:19:53 prd-ubuntu1804-docker-8c-16g-42096 sshd[1621]: Received disconnect from 10.30.104.4 port 50366:11: Closed due to user request. [preauth]
Aug 29 13:19:53 prd-ubuntu1804-docker-8c-16g-42096 sshd[1621]: Disconnected from invalid user jenkins 10.30.104.4 port 50366 [preauth]
Aug 29 13:19:55 prd-ubuntu1804-docker-8c-16g-42096 sshd[1623]: Invalid user jenkins from 10.30.104.4 port 50370
Aug 29 13:19:55 prd-ubuntu1804-docker-8c-16g-42096 sshd[1623]: Received disconnect from 10.30.104.4 port 50370:11: Closed due to user request. [preauth]
Aug 29 13:19:55 prd-ubuntu1804-docker-8c-16g-42096 sshd[1623]: Disconnected from invalid user jenkins 10.30.104.4 port 50370 [preauth]
Aug 29 13:19:57 prd-ubuntu1804-docker-8c-16g-42096 sshd[1625]: Invalid user jenkins from 10.30.104.4 port 50376
Aug 29 13:19:58 prd-ubuntu1804-docker-8c-16g-42096 sshd[1625]: Received disconnect from 10.30.104.4 port 50376:11: Closed due to user request. [preauth]
Aug 29 13:19:58 prd-ubuntu1804-docker-8c-16g-42096 sshd[1625]: Disconnected from invalid user jenkins 10.30.104.4 port 50376 [preauth]
Aug 29 13:20:00 prd-ubuntu1804-docker-8c-16g-42096 sshd[1627]: Invalid user jenkins from 10.30.104.4 port 50380
Aug 29 13:20:00 prd-ubuntu1804-docker-8c-16g-42096 sshd[1627]: Received disconnect from 10.30.104.4 port 50380:11: Closed due to user request. [preauth]
Aug 29 13:20:00 prd-ubuntu1804-docker-8c-16g-42096 sshd[1627]: Disconnected from invalid user jenkins 10.30.104.4 port 50380 [preauth]
Aug 29 13:20:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[1629]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:20:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[1629]: pam_unix(cron:session): session closed for user root
Aug 29 13:20:02 prd-ubuntu1804-docker-8c-16g-42096 sshd[1638]: Invalid user jenkins from 10.30.104.4 port 50390
Aug 29 13:20:02 prd-ubuntu1804-docker-8c-16g-42096 sshd[1638]: Received disconnect from 10.30.104.4 port 50390:11: Closed due to user request. [preauth]
Aug 29 13:20:02 prd-ubuntu1804-docker-8c-16g-42096 sshd[1638]: Disconnected from invalid user jenkins 10.30.104.4 port 50390 [preauth]
Aug 29 13:20:04 prd-ubuntu1804-docker-8c-16g-42096 sshd[1804]: Invalid user jenkins from 10.30.104.4 port 50396
Aug 29 13:20:04 prd-ubuntu1804-docker-8c-16g-42096 sshd[1804]: Received disconnect from 10.30.104.4 port 50396:11: Closed due to user request. [preauth]
Aug 29 13:20:04 prd-ubuntu1804-docker-8c-16g-42096 sshd[1804]: Disconnected from invalid user jenkins 10.30.104.4 port 50396 [preauth]
Aug 29 13:20:07 prd-ubuntu1804-docker-8c-16g-42096 sshd[1875]: Invalid user jenkins from 10.30.104.4 port 50402
Aug 29 13:20:07 prd-ubuntu1804-docker-8c-16g-42096 sshd[1875]: Received disconnect from 10.30.104.4 port 50402:11: Closed due to user request. [preauth]
Aug 29 13:20:07 prd-ubuntu1804-docker-8c-16g-42096 sshd[1875]: Disconnected from invalid user jenkins 10.30.104.4 port 50402 [preauth]
Aug 29 13:20:09 prd-ubuntu1804-docker-8c-16g-42096 sshd[1939]: Invalid user jenkins from 10.30.104.4 port 50414
Aug 29 13:20:09 prd-ubuntu1804-docker-8c-16g-42096 sshd[1939]: Received disconnect from 10.30.104.4 port 50414:11: Closed due to user request. [preauth]
Aug 29 13:20:09 prd-ubuntu1804-docker-8c-16g-42096 sshd[1939]: Disconnected from invalid user jenkins 10.30.104.4 port 50414 [preauth]
Aug 29 13:20:11 prd-ubuntu1804-docker-8c-16g-42096 sshd[1943]: Invalid user jenkins from 10.30.104.4 port 50418
Aug 29 13:20:11 prd-ubuntu1804-docker-8c-16g-42096 sshd[1943]: Received disconnect from 10.30.104.4 port 50418:11: Closed due to user request. [preauth]
Aug 29 13:20:11 prd-ubuntu1804-docker-8c-16g-42096 sshd[1943]: Disconnected from invalid user jenkins 10.30.104.4 port 50418 [preauth]
Aug 29 13:20:13 prd-ubuntu1804-docker-8c-16g-42096 sshd[1945]: Invalid user jenkins from 10.30.104.4 port 50422
Aug 29 13:20:13 prd-ubuntu1804-docker-8c-16g-42096 sshd[1945]: Received disconnect from 10.30.104.4 port 50422:11: Closed due to user request. [preauth]
Aug 29 13:20:13 prd-ubuntu1804-docker-8c-16g-42096 sshd[1945]: Disconnected from invalid user jenkins 10.30.104.4 port 50422 [preauth]
Aug 29 13:20:15 prd-ubuntu1804-docker-8c-16g-42096 sshd[1947]: Invalid user jenkins from 10.30.104.4 port 50424
Aug 29 13:20:15 prd-ubuntu1804-docker-8c-16g-42096 sshd[1947]: Received disconnect from 10.30.104.4 port 50424:11: Closed due to user request. [preauth]
Aug 29 13:20:15 prd-ubuntu1804-docker-8c-16g-42096 sshd[1947]: Disconnected from invalid user jenkins 10.30.104.4 port 50424 [preauth]
Aug 29 13:20:17 prd-ubuntu1804-docker-8c-16g-42096 sshd[1973]: Invalid user jenkins from 10.30.104.4 port 50428
Aug 29 13:20:17 prd-ubuntu1804-docker-8c-16g-42096 sshd[1973]: Received disconnect from 10.30.104.4 port 50428:11: Closed due to user request. [preauth]
Aug 29 13:20:17 prd-ubuntu1804-docker-8c-16g-42096 sshd[1973]: Disconnected from invalid user jenkins 10.30.104.4 port 50428 [preauth]
Aug 29 13:20:19 prd-ubuntu1804-docker-8c-16g-42096 sshd[1975]: Invalid user jenkins from 10.30.104.4 port 50434
Aug 29 13:20:20 prd-ubuntu1804-docker-8c-16g-42096 sshd[1975]: Received disconnect from 10.30.104.4 port 50434:11: Closed due to user request. [preauth]
Aug 29 13:20:20 prd-ubuntu1804-docker-8c-16g-42096 sshd[1975]: Disconnected from invalid user jenkins 10.30.104.4 port 50434 [preauth]
Aug 29 13:20:22 prd-ubuntu1804-docker-8c-16g-42096 sshd[1977]: Invalid user jenkins from 10.30.104.4 port 50436
Aug 29 13:20:22 prd-ubuntu1804-docker-8c-16g-42096 sshd[1977]: Received disconnect from 10.30.104.4 port 50436:11: Closed due to user request. [preauth]
Aug 29 13:20:22 prd-ubuntu1804-docker-8c-16g-42096 sshd[1977]: Disconnected from invalid user jenkins 10.30.104.4 port 50436 [preauth]
Aug 29 13:20:24 prd-ubuntu1804-docker-8c-16g-42096 sshd[1979]: Invalid user jenkins from 10.30.104.4 port 50444
Aug 29 13:20:25 prd-ubuntu1804-docker-8c-16g-42096 sshd[1979]: Received disconnect from 10.30.104.4 port 50444:11: Closed due to user request. [preauth]
Aug 29 13:20:25 prd-ubuntu1804-docker-8c-16g-42096 sshd[1979]: Disconnected from invalid user jenkins 10.30.104.4 port 50444 [preauth]
Aug 29 13:20:27 prd-ubuntu1804-docker-8c-16g-42096 sshd[1981]: Invalid user jenkins from 10.30.104.4 port 50448
Aug 29 13:20:27 prd-ubuntu1804-docker-8c-16g-42096 sshd[1981]: Received disconnect from 10.30.104.4 port 50448:11: Closed due to user request. [preauth]
Aug 29 13:20:27 prd-ubuntu1804-docker-8c-16g-42096 sshd[1981]: Disconnected from invalid user jenkins 10.30.104.4 port 50448 [preauth]
Aug 29 13:20:28 prd-ubuntu1804-docker-8c-16g-42096 useradd[2001]: new group: name=jenkins, GID=1001
Aug 29 13:20:28 prd-ubuntu1804-docker-8c-16g-42096 useradd[2001]: new user: name=jenkins, UID=1001, GID=1001, home=/home/jenkins, shell=/bin/bash
Aug 29 13:20:28 prd-ubuntu1804-docker-8c-16g-42096 usermod[2008]: add 'jenkins' to group 'docker'
Aug 29 13:20:28 prd-ubuntu1804-docker-8c-16g-42096 usermod[2008]: add 'jenkins' to shadow group 'docker'
Aug 29 13:20:29 prd-ubuntu1804-docker-8c-16g-42096 sshd[2069]: Accepted publickey for jenkins from 10.30.104.4 port 50452 ssh2: RSA SHA256:V0799BjlU//1ruj1g81rY7MeNIJkwAJ0Kr3lNX3XaN4
Aug 29 13:20:29 prd-ubuntu1804-docker-8c-16g-42096 sshd[2069]: pam_unix(sshd:session): session opened for user jenkins by (uid=0)
Aug 29 13:20:29 prd-ubuntu1804-docker-8c-16g-42096 systemd-logind[1164]: New session 2 of user jenkins.
Aug 29 13:20:29 prd-ubuntu1804-docker-8c-16g-42096 systemd: pam_unix(systemd-user:session): session opened for user jenkins by (uid=0)
Aug 29 13:21:02 prd-ubuntu1804-docker-8c-16g-42096 CRON[2655]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:21:02 prd-ubuntu1804-docker-8c-16g-42096 CRON[2655]: pam_unix(cron:session): session closed for user root
Aug 29 13:22:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2706]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:22:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2706]: pam_unix(cron:session): session closed for user root
Aug 29 13:22:11 prd-ubuntu1804-docker-8c-16g-42096 sudo:  jenkins : TTY=unknown ; PWD=/w/workspace/policy-clamp-master-verify-java ; USER=root ; COMMAND=/usr/bin/update-alternatives --install /usr/bin/java java /usr/lib/jvm/java-17-openjdk-amd64/bin/java 1
Aug 29 13:22:11 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Aug 29 13:22:11 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session closed for user root
Aug 29 13:22:11 prd-ubuntu1804-docker-8c-16g-42096 sudo:  jenkins : TTY=unknown ; PWD=/w/workspace/policy-clamp-master-verify-java ; USER=root ; COMMAND=/usr/bin/update-alternatives --install /usr/bin/javac javac /usr/lib/jvm/java-17-openjdk-amd64/bin/javac 1
Aug 29 13:22:11 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session closed for user root
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo:  jenkins : TTY=unknown ; PWD=/w/workspace/policy-clamp-master-verify-java ; USER=root ; COMMAND=/usr/bin/update-alternatives --install /usr/lib/jvm/java-openjdk java_sdk_openjdk /usr/lib/jvm/java-17-openjdk-amd64 1
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session closed for user root
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo:  jenkins : TTY=unknown ; PWD=/w/workspace/policy-clamp-master-verify-java ; USER=root ; COMMAND=/usr/bin/update-alternatives --set java /usr/lib/jvm/java-17-openjdk-amd64/bin/java
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session closed for user root
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo:  jenkins : TTY=unknown ; PWD=/w/workspace/policy-clamp-master-verify-java ; USER=root ; COMMAND=/usr/bin/update-alternatives --set javac /usr/lib/jvm/java-17-openjdk-amd64/bin/javac
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session closed for user root
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo:  jenkins : TTY=unknown ; PWD=/w/workspace/policy-clamp-master-verify-java ; USER=root ; COMMAND=/usr/bin/update-alternatives --set java_sdk_openjdk /usr/lib/jvm/java-17-openjdk-amd64
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Aug 29 13:22:12 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session closed for user root
Aug 29 13:23:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2869]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:23:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2869]: pam_unix(cron:session): session closed for user root
Aug 29 13:24:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2873]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:24:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2873]: pam_unix(cron:session): session closed for user root
Aug 29 13:25:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2886]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:25:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2886]: pam_unix(cron:session): session closed for user root
Aug 29 13:26:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2894]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:26:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2894]: pam_unix(cron:session): session closed for user root
Aug 29 13:27:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2901]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:27:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2901]: pam_unix(cron:session): session closed for user root
Aug 29 13:28:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2935]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:28:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2935]: pam_unix(cron:session): session closed for user root
Aug 29 13:29:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2948]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:29:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2948]: pam_unix(cron:session): session closed for user root
Aug 29 13:30:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2954]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:30:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2954]: pam_unix(cron:session): session closed for user root
Aug 29 13:31:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2957]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:31:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2957]: pam_unix(cron:session): session closed for user root
Aug 29 13:32:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2965]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:32:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2965]: pam_unix(cron:session): session closed for user root
Aug 29 13:33:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2968]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:33:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2968]: pam_unix(cron:session): session closed for user root
Aug 29 13:34:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2978]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:34:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2978]: pam_unix(cron:session): session closed for user root
Aug 29 13:35:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2998]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:35:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[2998]: pam_unix(cron:session): session closed for user root
Aug 29 13:36:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3007]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:36:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3007]: pam_unix(cron:session): session closed for user root
Aug 29 13:37:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3010]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:37:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3010]: pam_unix(cron:session): session closed for user root
Aug 29 13:38:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3017]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:38:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3017]: pam_unix(cron:session): session closed for user root
Aug 29 13:39:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3020]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:39:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3020]: pam_unix(cron:session): session closed for user root
Aug 29 13:40:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3025]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:40:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3025]: pam_unix(cron:session): session closed for user root
Aug 29 13:41:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3028]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:41:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3028]: pam_unix(cron:session): session closed for user root
Aug 29 13:42:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3032]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:42:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3032]: pam_unix(cron:session): session closed for user root
Aug 29 13:43:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3460]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:43:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[3460]: pam_unix(cron:session): session closed for user root
Aug 29 13:44:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[4182]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:44:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[4182]: pam_unix(cron:session): session closed for user root
Aug 29 13:45:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[4672]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:45:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[4672]: pam_unix(cron:session): session closed for user root
Aug 29 13:46:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[5198]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:46:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[5198]: pam_unix(cron:session): session closed for user root
Aug 29 13:47:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[5760]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 29 13:47:01 prd-ubuntu1804-docker-8c-16g-42096 CRON[5760]: pam_unix(cron:session): session closed for user root
Aug 29 13:47:34 prd-ubuntu1804-docker-8c-16g-42096 sudo:  jenkins : TTY=unknown ; PWD=/w/workspace/policy-clamp-master-verify-java ; USER=root ; COMMAND=/bin/cp /var/log/auth.log /tmp
Aug 29 13:47:34 prd-ubuntu1804-docker-8c-16g-42096 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)