Jan 29 15:00:48 prd-ubuntu2204-docker-8c-8g-5751 passwd[740]: password for 'ubuntu' changed by 'root' Jan 29 15:00:48 prd-ubuntu2204-docker-8c-8g-5751 systemd-logind[773]: New seat seat0. Jan 29 15:00:48 prd-ubuntu2204-docker-8c-8g-5751 systemd-logind[773]: Watching system buttons on /dev/input/event0 (Power Button) Jan 29 15:00:48 prd-ubuntu2204-docker-8c-8g-5751 systemd-logind[773]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard) Jan 29 15:00:48 prd-ubuntu2204-docker-8c-8g-5751 sshd[826]: Server listening on 0.0.0.0 port 22. Jan 29 15:00:48 prd-ubuntu2204-docker-8c-8g-5751 sshd[826]: Server listening on :: port 22. Jan 29 15:00:51 prd-ubuntu2204-docker-8c-8g-5751 sshd[1036]: error: kex_exchange_identification: Connection closed by remote host Jan 29 15:00:51 prd-ubuntu2204-docker-8c-8g-5751 sshd[1036]: Connection closed by 10.30.168.15 port 49954 Jan 29 15:00:58 prd-ubuntu2204-docker-8c-8g-5751 sshd[1044]: Invalid user jenkins from 10.30.168.15 port 49958 Jan 29 15:00:58 prd-ubuntu2204-docker-8c-8g-5751 sshd[1044]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] Jan 29 15:00:58 prd-ubuntu2204-docker-8c-8g-5751 sshd[1044]: Received disconnect from 10.30.168.15 port 49958:11: Closed due to user request. [preauth] Jan 29 15:00:58 prd-ubuntu2204-docker-8c-8g-5751 sshd[1044]: Disconnected from invalid user jenkins 10.30.168.15 port 49958 [preauth] Jan 29 15:01:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[1046]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:01:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[1046]: pam_unix(cron:session): session closed for user root Jan 29 15:01:01 prd-ubuntu2204-docker-8c-8g-5751 sshd[1049]: Invalid user jenkins from 10.30.168.15 port 49960 Jan 29 15:01:01 prd-ubuntu2204-docker-8c-8g-5751 sshd[1049]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] Jan 29 15:01:01 prd-ubuntu2204-docker-8c-8g-5751 sshd[1049]: Received disconnect from 10.30.168.15 port 49960:11: Closed due to user request. [preauth] Jan 29 15:01:01 prd-ubuntu2204-docker-8c-8g-5751 sshd[1049]: Disconnected from invalid user jenkins 10.30.168.15 port 49960 [preauth] Jan 29 15:01:04 prd-ubuntu2204-docker-8c-8g-5751 sshd[1051]: Invalid user jenkins from 10.30.168.15 port 49962 Jan 29 15:01:04 prd-ubuntu2204-docker-8c-8g-5751 sshd[1051]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] Jan 29 15:01:04 prd-ubuntu2204-docker-8c-8g-5751 sshd[1051]: Received disconnect from 10.30.168.15 port 49962:11: Closed due to user request. [preauth] Jan 29 15:01:04 prd-ubuntu2204-docker-8c-8g-5751 sshd[1051]: Disconnected from invalid user jenkins 10.30.168.15 port 49962 [preauth] Jan 29 15:01:07 prd-ubuntu2204-docker-8c-8g-5751 sshd[1284]: Invalid user jenkins from 10.30.168.15 port 49966 Jan 29 15:01:08 prd-ubuntu2204-docker-8c-8g-5751 sshd[1284]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] Jan 29 15:01:08 prd-ubuntu2204-docker-8c-8g-5751 sshd[1284]: Received disconnect from 10.30.168.15 port 49966:11: Closed due to user request. [preauth] Jan 29 15:01:08 prd-ubuntu2204-docker-8c-8g-5751 sshd[1284]: Disconnected from invalid user jenkins 10.30.168.15 port 49966 [preauth] Jan 29 15:01:10 prd-ubuntu2204-docker-8c-8g-5751 sshd[1393]: Invalid user jenkins from 10.30.168.15 port 49970 Jan 29 15:01:10 prd-ubuntu2204-docker-8c-8g-5751 sshd[1393]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] Jan 29 15:01:10 prd-ubuntu2204-docker-8c-8g-5751 sshd[1393]: Received disconnect from 10.30.168.15 port 49970:11: Closed due to user request. [preauth] Jan 29 15:01:10 prd-ubuntu2204-docker-8c-8g-5751 sshd[1393]: Disconnected from invalid user jenkins 10.30.168.15 port 49970 [preauth] Jan 29 15:01:13 prd-ubuntu2204-docker-8c-8g-5751 useradd[1426]: new group: name=jenkins, GID=1001 Jan 29 15:01:13 prd-ubuntu2204-docker-8c-8g-5751 useradd[1426]: new user: name=jenkins, UID=1001, GID=1001, home=/home/jenkins, shell=/bin/bash, from=none Jan 29 15:01:13 prd-ubuntu2204-docker-8c-8g-5751 usermod[1435]: add 'jenkins' to group 'docker' Jan 29 15:01:13 prd-ubuntu2204-docker-8c-8g-5751 usermod[1435]: add 'jenkins' to shadow group 'docker' Jan 29 15:01:13 prd-ubuntu2204-docker-8c-8g-5751 sshd[1448]: userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth] Jan 29 15:01:13 prd-ubuntu2204-docker-8c-8g-5751 sshd[1448]: Received disconnect from 10.30.168.15 port 49972:11: Closed due to user request. [preauth] Jan 29 15:01:13 prd-ubuntu2204-docker-8c-8g-5751 sshd[1448]: Disconnected from authenticating user jenkins 10.30.168.15 port 49972 [preauth] Jan 29 15:01:16 prd-ubuntu2204-docker-8c-8g-5751 sshd[1471]: Accepted publickey for jenkins from 10.30.168.15 port 49974 ssh2: RSA SHA256:BBsm4mRgG5V0fGum4Y1Rmy/vs16stdRVhwvexlLUhUs Jan 29 15:01:16 prd-ubuntu2204-docker-8c-8g-5751 sshd[1471]: pam_unix(sshd:session): session opened for user jenkins(uid=1001) by (uid=0) Jan 29 15:01:16 prd-ubuntu2204-docker-8c-8g-5751 systemd-logind[773]: New session 2 of user jenkins. Jan 29 15:01:16 prd-ubuntu2204-docker-8c-8g-5751 systemd: pam_unix(systemd-user:session): session opened for user jenkins(uid=1001) by (uid=0) Jan 29 15:02:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[1969]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:02:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[1969]: pam_unix(cron:session): session closed for user root Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: jenkins : PWD=/w/workspace/bgpcep-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --install /usr/bin/java java /usr/lib/jvm/java-21-openjdk-amd64/bin/java 1 Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session closed for user root Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: jenkins : PWD=/w/workspace/bgpcep-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --install /usr/bin/javac javac /usr/lib/jvm/java-21-openjdk-amd64/bin/javac 1 Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session closed for user root Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: jenkins : PWD=/w/workspace/bgpcep-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --install /usr/lib/jvm/java-openjdk java_sdk_openjdk /usr/lib/jvm/java-21-openjdk-amd64 1 Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session closed for user root Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: jenkins : PWD=/w/workspace/bgpcep-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --set java /usr/lib/jvm/java-21-openjdk-amd64/bin/java Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session closed for user root Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: jenkins : PWD=/w/workspace/bgpcep-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --set javac /usr/lib/jvm/java-21-openjdk-amd64/bin/javac Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session closed for user root Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: jenkins : PWD=/w/workspace/bgpcep-maven-merge-master ; USER=root ; COMMAND=/usr/bin/update-alternatives --set java_sdk_openjdk /usr/lib/jvm/java-21-openjdk-amd64 Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 29 15:02:32 prd-ubuntu2204-docker-8c-8g-5751 sudo: pam_unix(sudo:session): session closed for user root Jan 29 15:03:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[2116]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:03:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[2116]: pam_unix(cron:session): session closed for user root Jan 29 15:04:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[2121]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:04:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[2121]: pam_unix(cron:session): session closed for user root Jan 29 15:05:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[2125]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:05:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[2125]: pam_unix(cron:session): session closed for user root Jan 29 15:06:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[2500]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:06:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[2500]: pam_unix(cron:session): session closed for user root Jan 29 15:07:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[2753]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:07:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[2753]: pam_unix(cron:session): session closed for user root Jan 29 15:08:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[3009]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:08:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[3009]: pam_unix(cron:session): session closed for user root Jan 29 15:09:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[4363]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:09:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[4363]: pam_unix(cron:session): session closed for user root Jan 29 15:10:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[5865]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:10:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[5865]: pam_unix(cron:session): session closed for user root Jan 29 15:11:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[7584]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:11:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[7584]: pam_unix(cron:session): session closed for user root Jan 29 15:12:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[8513]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:12:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[8513]: pam_unix(cron:session): session closed for user root Jan 29 15:13:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[9607]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:13:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[9607]: pam_unix(cron:session): session closed for user root Jan 29 15:14:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[10143]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:14:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[10143]: pam_unix(cron:session): session closed for user root Jan 29 15:15:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[10858]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:15:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[10858]: pam_unix(cron:session): session closed for user root Jan 29 15:16:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[11561]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:16:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[11561]: pam_unix(cron:session): session closed for user root Jan 29 15:17:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[12860]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:17:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[12861]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:17:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[12860]: pam_unix(cron:session): session closed for user root Jan 29 15:17:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[12861]: pam_unix(cron:session): session closed for user root Jan 29 15:18:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[15071]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:18:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[15071]: pam_unix(cron:session): session closed for user root Jan 29 15:19:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[16937]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:19:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[16937]: pam_unix(cron:session): session closed for user root Jan 29 15:20:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[18085]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:20:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[18085]: pam_unix(cron:session): session closed for user root Jan 29 15:21:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[18099]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:21:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[18099]: pam_unix(cron:session): session closed for user root Jan 29 15:22:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[19886]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:22:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[19886]: pam_unix(cron:session): session closed for user root Jan 29 15:23:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[21333]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:23:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[21333]: pam_unix(cron:session): session closed for user root Jan 29 15:24:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[22470]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:24:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[22470]: pam_unix(cron:session): session closed for user root Jan 29 15:25:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[23640]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:25:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[23640]: pam_unix(cron:session): session closed for user root Jan 29 15:26:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[25835]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:26:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[25835]: pam_unix(cron:session): session closed for user root Jan 29 15:27:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[27561]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:27:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[27561]: pam_unix(cron:session): session closed for user root Jan 29 15:28:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[28905]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:28:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[28905]: pam_unix(cron:session): session closed for user root Jan 29 15:29:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[30147]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:29:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[30147]: pam_unix(cron:session): session closed for user root Jan 29 15:30:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[31830]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:30:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[31830]: pam_unix(cron:session): session closed for user root Jan 29 15:31:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[33105]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:31:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[33105]: pam_unix(cron:session): session closed for user root Jan 29 15:32:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[34199]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:32:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[34199]: pam_unix(cron:session): session closed for user root Jan 29 15:33:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[35593]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:33:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[35593]: pam_unix(cron:session): session closed for user root Jan 29 15:34:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[37244]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:34:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[37244]: pam_unix(cron:session): session closed for user root Jan 29 15:35:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[38671]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:35:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[38671]: pam_unix(cron:session): session closed for user root Jan 29 15:36:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[40128]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:36:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[40128]: pam_unix(cron:session): session closed for user root Jan 29 15:37:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[40773]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:37:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[40773]: pam_unix(cron:session): session closed for user root Jan 29 15:38:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[41276]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:38:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[41276]: pam_unix(cron:session): session closed for user root Jan 29 15:39:02 prd-ubuntu2204-docker-8c-8g-5751 CRON[41280]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:39:02 prd-ubuntu2204-docker-8c-8g-5751 CRON[41280]: pam_unix(cron:session): session closed for user root Jan 29 15:40:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[41285]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:40:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[41285]: pam_unix(cron:session): session closed for user root Jan 29 15:41:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[41292]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:41:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[41292]: pam_unix(cron:session): session closed for user root Jan 29 15:42:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[41334]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) Jan 29 15:42:01 prd-ubuntu2204-docker-8c-8g-5751 CRON[41334]: pam_unix(cron:session): session closed for user root Jan 29 15:42:31 prd-ubuntu2204-docker-8c-8g-5751 sudo: jenkins : PWD=/w/workspace/bgpcep-maven-merge-master ; USER=root ; COMMAND=/usr/bin/cp /var/log/auth.log /tmp