<134>Oct 28 10:38:27 centos6 audispd: node=centos6 type=USER_END msg=audit(1446028707.131:1045): user pid=1541 uid=0 auid=503 ses=7 subj=system_u:system_r:local_login_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="test123" exe="/bin/login" hostname=? addr=? terminal=tty1 res=success'