fleet-auditd Fleet auditd: $(audit.type) on $(audit.node) 100100 ^USER_LOGIN$|^USER_AUTH$|^USER_ACCT$|^USER_ERR$|^CRED_ Fleet audit: authentication event $(audit.type) on $(audit.node) authentication, 100110 ^failed$|^no$|^0$ Fleet audit: FAILED authentication $(audit.type) on $(audit.node) authentication_failed, 100100 ^AVC$|^SELINUX_ERR$|^ANOM_|^USER_AVC$ Fleet audit: SELinux/anomaly $(audit.type) on $(audit.node) 100100 ^USER_CMD$|^USYS_CONFIG$|^ADD_USER$|^DEL_USER$|^ADD_GROUP$|^ROLE_ Fleet audit: privileged/config event $(audit.type) on $(audit.node)