<123>Oct 28 10:33:44 centos6 audispd: node=centos6 type=USER_END msg=audit(1446028424.849:973): user pid=1501 uid=0 auid=503 ses=6 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:session_close acct="test123" exe="/usr/sbin/sshd" hostname=192.168.56.1 addr=192.168.56.1 terminal=ssh res=success'