opened for user smmsp by (uid=0)
Apr 27 09:20:01 ip-172-31-29-215 CRON[10781]: pam_unix(cron:session): session closed for user smmsp
Apr 27 09:39:01 ip-172-31-29-215 CRON[10811]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 27 09:39:01 ip-172-31-29-215 CRON[10811]: pam_unix(cron:session): session closed for user root
Apr 27 09:40:01 ip-172-31-29-215 CRON[10867]: pam_unix(cron:session): session opened for user smmsp by (uid=0)
Apr 27 09:40:01 ip-172-31-29-215 CRON[10867]: pam_unix(cron:session): session closed for user smmsp
Apr 27 10:00:01 ip-172-31-29-215 CRON[10898]: pam_unix(cron:session): session opened for user smmsp by (uid=0)
Apr 27 10:00:01 ip-172-31-29-215 CRON[10898]: pam_unix(cron:session): session closed for user smmsp
Apr 27 10:02:46 ip-172-31-29-215 sshd[10923]: Invalid user aptuslegal from 185.93.89.29 port 48988
Apr 27 10:02:46 ip-172-31-29-215 sshd[10923]: Connection closed by invalid user aptuslegal 185.93.89.29 port 48988 [preauth]
Apr 27 10:03:38 ip-172-31-29-215 sshd[10925]: Invalid user aptuslegal from 172.94.9.64 port 48020
Apr 27 10:03:39 ip-172-31-29-215 sshd[10925]: Connection closed by invalid user aptuslegal 172.94.9.64 port 48020 [preauth]
Apr 27 10:04:53 ip-172-31-29-215 sshd[10927]: Invalid user aptuslegal from 77.90.185.105 port 46378
Apr 27 10:04:53 ip-172-31-29-215 sshd[10927]: Connection closed by invalid user aptuslegal 77.90.185.105 port 46378 [preauth]
Apr 27 10:05:51 ip-172-31-29-215 sshd[10930]: Connection closed by authenticating user root 172.94.9.63 port 37726 [preauth]
Apr 27 10:06:37 ip-172-31-29-215 sshd[10933]: Connection closed by authenticating user root 172.94.9.57 port 57614 [preauth]
Apr 27 10:09:01 ip-172-31-29-215 CRON[10935]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 27 10:09:01 ip-172-31-29-215 CRON[10935]: pam_unix(cron:session): session closed for user root
Apr 27 10:17:01 ip-172-31-29-215 CRON[10996]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 27 10:17:01 ip-172-31-29-215 CRON[10996]: pam_unix(cron:session): session closed for user root
Apr 27 10:20:01 ip-172-31-29-215 CRON[11000]: pam_unix(cron:session): session opened for user smmsp by (uid=0)
Apr 27 10:20:01 ip-172-31-29-215 CRON[11000]: pam_unix(cron:session): session closed for user smmsp
Apr 27 10:39:01 ip-172-31-29-215 CRON[11028]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 27 10:39:01 ip-172-31-29-215 CRON[11028]: pam_unix(cron:session): session closed for user root
Apr 27 10:40:01 ip-172-31-29-215 CRON[11084]: pam_unix(cron:session): session opened for user smmsp by (uid=0)
Apr 27 10:40:01 ip-172-31-29-215 CRON[11084]: pam_unix(cron:session): session closed for user smmsp
Apr 27 10:44:06 ip-172-31-29-215 sshd[11110]: Accepted publickey for ubuntu from 187.189.166.45 port 52326 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:44:06 ip-172-31-29-215 sshd[11110]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:44:06 ip-172-31-29-215 systemd-logind[517]: New session 229 of user ubuntu.
Apr 27 10:44:06 ip-172-31-29-215 systemd: pam_unix(systemd-user:session): session opened for user ubuntu by (uid=0)
Apr 27 10:44:32 ip-172-31-29-215 dbus-daemon[490]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms)
Apr 27 10:47:28 ip-172-31-29-215 sshd[11560]: Accepted publickey for ubuntu from 187.189.166.45 port 62744 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:47:28 ip-172-31-29-215 sshd[11560]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:47:28 ip-172-31-29-215 systemd-logind[517]: New session 231 of user ubuntu.
Apr 27 10:47:29 ip-172-31-29-215 sshd[11219]: Received disconnect from 187.189.166.45 port 52326:11: disconnected by user
Apr 27 10:47:29 ip-172-31-29-215 sshd[11219]: Disconnected from user ubuntu 187.189.166.45 port 52326
Apr 27 10:47:29 ip-172-31-29-215 sshd[11110]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 10:47:29 ip-172-31-29-215 systemd-logind[517]: Session 229 logged out. Waiting for processes to exit.
Apr 27 10:47:35 ip-172-31-29-215 sshd[11635]: Received disconnect from 187.189.166.45 port 62744:11: disconnected by user
Apr 27 10:47:35 ip-172-31-29-215 sshd[11635]: Disconnected from user ubuntu 187.189.166.45 port 62744
Apr 27 10:47:35 ip-172-31-29-215 sshd[11560]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 10:47:35 ip-172-31-29-215 systemd-logind[517]: Session 231 logged out. Waiting for processes to exit.
Apr 27 10:47:37 ip-172-31-29-215 sshd[11772]: Accepted publickey for ubuntu from 187.189.166.45 port 59748 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:47:37 ip-172-31-29-215 sshd[11772]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:47:37 ip-172-31-29-215 systemd-logind[517]: New session 232 of user ubuntu.
Apr 27 10:48:19 ip-172-31-29-215 sshd[12035]: Accepted publickey for ubuntu from 187.184.121.29 port 49215 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:48:19 ip-172-31-29-215 sshd[12035]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:48:19 ip-172-31-29-215 systemd-logind[517]: New session 233 of user ubuntu.
Apr 27 10:49:39 ip-172-31-29-215 sshd[11836]: Received disconnect from 187.189.166.45 port 59748:11: disconnected by user
Apr 27 10:49:39 ip-172-31-29-215 sshd[11836]: Disconnected from user ubuntu 187.189.166.45 port 59748
Apr 27 10:49:39 ip-172-31-29-215 sshd[11772]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 10:49:39 ip-172-31-29-215 systemd-logind[517]: Session 232 logged out. Waiting for processes to exit.
Apr 27 10:49:42 ip-172-31-29-215 sshd[12328]: Accepted publickey for ubuntu from 187.189.166.45 port 56804 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:49:42 ip-172-31-29-215 sshd[12328]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:49:42 ip-172-31-29-215 systemd-logind[517]: New session 234 of user ubuntu.
Apr 27 10:50:22 ip-172-31-29-215 sshd[12531]: Accepted publickey for ubuntu from 189.203.193.116 port 19520 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:50:22 ip-172-31-29-215 sshd[12531]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:50:22 ip-172-31-29-215 systemd-logind[517]: New session 235 of user ubuntu.
Apr 27 10:50:28 ip-172-31-29-215 systemd-logind[517]: Removed session 231.
Apr 27 10:50:34 ip-172-31-29-215 sshd[12735]: Accepted publickey for ubuntu from 187.189.166.45 port 56041 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:50:34 ip-172-31-29-215 sshd[12735]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:50:34 ip-172-31-29-215 systemd-logind[517]: New session 236 of user ubuntu.
Apr 27 10:50:37 ip-172-31-29-215 systemd-logind[517]: Removed session 232.
Apr 27 10:51:19 ip-172-31-29-215 sshd[13273]: Accepted publickey for ubuntu from 189.203.193.116 port 19678 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:51:19 ip-172-31-29-215 sshd[13273]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:51:19 ip-172-31-29-215 systemd-logind[517]: New session 237 of user ubuntu.
Apr 27 10:51:49 ip-172-31-29-215 sshd[12403]: Received disconnect from 187.189.166.45 port 56804:11: disconnected by user
Apr 27 10:51:49 ip-172-31-29-215 sshd[12403]: Disconnected from user ubuntu 187.189.166.45 port 56804
Apr 27 10:51:49 ip-172-31-29-215 sshd[12328]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 10:51:49 ip-172-31-29-215 systemd-logind[517]: Session 234 logged out. Waiting for processes to exit.
Apr 27 10:51:52 ip-172-31-29-215 sshd[12829]: Received disconnect from 187.189.166.45 port 56041:11: disconnected by user
Apr 27 10:51:52 ip-172-31-29-215 sshd[12829]: Disconnected from user ubuntu 187.189.166.45 port 56041
Apr 27 10:51:52 ip-172-31-29-215 sshd[12735]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 10:51:52 ip-172-31-29-215 systemd-logind[517]: Session 236 logged out. Waiting for processes to exit.
Apr 27 10:51:57 ip-172-31-29-215 sshd[12099]: Received disconnect from 187.184.121.29 port 49215:11: disconnected by user
Apr 27 10:51:57 ip-172-31-29-215 sshd[12099]: Disconnected from user ubuntu 187.184.121.29 port 49215
Apr 27 10:51:57 ip-172-31-29-215 sshd[12035]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 10:51:57 ip-172-31-29-215 systemd-logind[517]: Session 233 logged out. Waiting for processes to exit.
Apr 27 10:52:20 ip-172-31-29-215 sshd[13273]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 10:52:20 ip-172-31-29-215 sshd[12531]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 10:52:20 ip-172-31-29-215 sshd[779]: Received signal 15; terminating.
Apr 27 10:53:41 ip-172-31-29-215 systemd-logind[514]: Watching system buttons on /dev/input/event0 (Power Button)
Apr 27 10:53:41 ip-172-31-29-215 systemd-logind[514]: Watching system buttons on /dev/input/event1 (Sleep Button)
Apr 27 10:53:41 ip-172-31-29-215 systemd-logind[514]: Watching system buttons on /dev/input/event2 (AT Translated Set 2 keyboard)
Apr 27 10:53:41 ip-172-31-29-215 systemd-logind[514]: New seat seat0.
Apr 27 10:53:41 ip-172-31-29-215 su: (to smmsp) root on none
Apr 27 10:53:41 ip-172-31-29-215 su: pam_unix(su:session): session opened for user smmsp by (uid=0)
Apr 27 10:53:41 ip-172-31-29-215 systemd: pam_unix(systemd-user:session): session opened for user smmsp by (uid=0)
Apr 27 10:53:41 ip-172-31-29-215 sshd[783]: Server listening on 0.0.0.0 port 22.
Apr 27 10:53:41 ip-172-31-29-215 sshd[783]: Server listening on :: port 22.
Apr 27 10:53:41 ip-172-31-29-215 su: pam_unix(su:session): session closed for user smmsp
Apr 27 10:53:51 ip-172-31-29-215 gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0)
Apr 27 10:53:51 ip-172-31-29-215 systemd-logind[514]: New session c2 of user gdm.
Apr 27 10:53:51 ip-172-31-29-215 systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0)
Apr 27 10:53:52 ip-172-31-29-215 gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session closed for user gdm
Apr 27 10:53:52 ip-172-31-29-215 systemd-logind[514]: Session c2 logged out. Waiting for processes to exit.
Apr 27 10:53:52 ip-172-31-29-215 systemd-logind[514]: Removed session c2.
Apr 27 10:53:52 ip-172-31-29-215 gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0)
Apr 27 10:53:52 ip-172-31-29-215 systemd-logind[514]: New session c3 of user gdm.
Apr 27 10:53:54 ip-172-31-29-215 polkitd(authority=local): Registered Authentication Agent for unix-session:c3 (system bus name :1.97 [/usr/bin/gnome-shell], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Apr 27 10:54:17 ip-172-31-29-215 dbus-daemon[489]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms)
Apr 27 10:55:32 ip-172-31-29-215 sshd[1387]: Accepted publickey for ubuntu from 189.203.193.116 port 19508 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:55:32 ip-172-31-29-215 sshd[1387]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:55:32 ip-172-31-29-215 systemd-logind[514]: New session 3 of user ubuntu.
Apr 27 10:55:32 ip-172-31-29-215 systemd: pam_unix(systemd-user:session): session opened for user ubuntu by (uid=0)
Apr 27 10:55:54 ip-172-31-29-215 sshd[1506]: Accepted publickey for ubuntu from 187.189.166.45 port 58077 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:55:54 ip-172-31-29-215 sshd[1506]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:55:54 ip-172-31-29-215 systemd-logind[514]: New session 5 of user ubuntu.
Apr 27 10:55:57 ip-172-31-29-215 dbus-daemon[489]: [system] Failed to activate service 'org.bluez': timed out (service_start_timeout=25000ms)
Apr 27 10:56:14 ip-172-31-29-215 sshd[1770]: Accepted publickey for ubuntu from 187.184.121.29 port 55655 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:56:14 ip-172-31-29-215 sshd[1770]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:56:14 ip-172-31-29-215 systemd-logind[514]: New session 6 of user ubuntu.
Apr 27 10:56:29 ip-172-31-29-215 sshd[1833]: Received disconnect from 187.184.121.29 port 55655:11: disconnected by user
Apr 27 10:56:29 ip-172-31-29-215 sshd[1833]: Disconnected from user ubuntu 187.184.121.29 port 55655
Apr 27 10:56:29 ip-172-31-29-215 sshd[1770]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 10:56:29 ip-172-31-29-215 systemd-logind[514]: Session 6 logged out. Waiting for processes to exit.
Apr 27 10:56:37 ip-172-31-29-215 sshd[2063]: Accepted publickey for ubuntu from 187.184.121.29 port 50064 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:56:37 ip-172-31-29-215 sshd[2063]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:56:37 ip-172-31-29-215 systemd-logind[514]: New session 7 of user ubuntu.
Apr 27 10:58:19 ip-172-31-29-215 sshd[2259]: Accepted publickey for ubuntu from 187.184.121.29 port 51076 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:58:19 ip-172-31-29-215 sshd[2259]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:58:19 ip-172-31-29-215 systemd-logind[514]: New session 8 of user ubuntu.
Apr 27 10:58:40 ip-172-31-29-215 sshd[2333]: Received disconnect from 187.184.121.29 port 51076:11: disconnected by user
Apr 27 10:58:40 ip-172-31-29-215 sshd[2333]: Disconnected from user ubuntu 187.184.121.29 port 51076
Apr 27 10:58:40 ip-172-31-29-215 sshd[2259]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 10:58:40 ip-172-31-29-215 systemd-logind[514]: Session 8 logged out. Waiting for processes to exit.
Apr 27 10:58:45 ip-172-31-29-215 sshd[2468]: Accepted publickey for ubuntu from 187.184.121.29 port 50677 ssh2: RSA SHA256:Zqk1VR7n9VKAJSML2oy4Swt5sm7d+ABJKnVgCDEu32k
Apr 27 10:58:45 ip-172-31-29-215 sshd[2468]: pam_unix(sshd:session): session opened for user ubuntu by (uid=0)
Apr 27 10:58:45 ip-172-31-29-215 systemd-logind[514]: New session 9 of user ubuntu.
Apr 27 11:00:01 ip-172-31-29-215 CRON[2641]: pam_unix(cron:session): session opened for user smmsp by (uid=0)
Apr 27 11:00:01 ip-172-31-29-215 CRON[2641]: pam_unix(cron:session): session closed for user smmsp
Apr 27 11:01:04 ip-172-31-29-215 sshd[1494]: Received disconnect from 189.203.193.116 port 19508:11: disconnected by user
Apr 27 11:01:04 ip-172-31-29-215 sshd[1494]: Disconnected from user ubuntu 189.203.193.116 port 19508
Apr 27 11:01:04 ip-172-31-29-215 sshd[1387]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 11:01:04 ip-172-31-29-215 systemd-logind[514]: Session 3 logged out. Waiting for processes to exit.
Apr 27 11:01:05 ip-172-31-29-215 systemd-logind[514]: Removed session 3.
Apr 27 11:01:05 ip-172-31-29-215 sshd[2531]: Received disconnect from 187.184.121.29 port 50677:11: disconnected by user
Apr 27 11:01:05 ip-172-31-29-215 sshd[2531]: Disconnected from user ubuntu 187.184.121.29 port 50677
Apr 27 11:01:05 ip-172-31-29-215 sshd[2468]: pam_unix(sshd:session): session closed for user ubuntu
Apr 27 11:01:05 ip-172-31-29-215 systemd-logind[514]: Session 9 logged out. Waiting for processes to exit.
Apr 27 11:01:13 ip-172-31-29-215 sshd[2667]: Invalid user aptuslegal from 77.90.185.45 port 51672
Apr 27 11:01:14 ip-172-31-29-215 sshd[2667]: Connection closed by invalid user aptuslegal 77.90.185.45 port 51672 [preauth]
Apr 27 11:01:20 ip-172-31-29-215 systemd-logind[514]: Removed session 8.
Apr 27 11:01:46 ip-172-31-29-215 systemd-logind[514]: Removed session 9.
Apr 27 11:09:01 ip-172-31-29-215 CRON[2686]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 27 11:09:01 ip-172-31-29-215 CRON[2686]: pam_unix(cron:session): session closed for user root
Apr 27 11:12:13 ip-172-31-29-215 sudo:   ubuntu : TTY=pts/0 ; PWD=/home/ubuntu ; USER=root ; COMMAND=/usr/bin/crontab -l
Apr 27 11:12:13 ip-172-31-29-215 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Apr 27 11:12:13 ip-172-31-29-215 sudo: pam_unix(sudo:session): session closed for user root
Apr 27 11:17:01 ip-172-31-29-215 CRON[3068]: pam_unix(cron:session): session opened for user root by (uid=0)
Apr 27 11:17:01 ip-172-31-29-215 CRON[3068]: pam_unix(cron:session): session closed for user root
Apr 27 11:17:12 ip-172-31-29-215 sudo:   ubuntu : TTY=pts/0 ; PWD=/home/ubuntu ; USER=root ; COMMAND=/usr/bin/apt install extundelete -y
Apr 27 11:17:12 ip-172-31-29-215 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Apr 27 11:17:18 ip-172-31-29-215 sudo: pam_unix(sudo:session): session closed for user root
Apr 27 11:17:57 ip-172-31-29-215 sudo:   ubuntu : TTY=pts/0 ; PWD=/home/ubuntu ; USER=root ; COMMAND=/usr/bin/mkdir /recover
Apr 27 11:17:57 ip-172-31-29-215 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Apr 27 11:17:57 ip-172-31-29-215 sudo: pam_unix(sudo:session): session closed for user root
Apr 27 11:18:13 ip-172-31-29-215 sudo:   ubuntu : TTY=pts/0 ; PWD=/recover ; USER=root ; COMMAND=/usr/bin/extundelete /dev/xvda1 --restore-directory var/www/html
Apr 27 11:18:13 ip-172-31-29-215 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Apr 27 11:18:19 ip-172-31-29-215 sudo: pam_unix(sudo:session): session closed for user root
Apr 27 11:18:44 ip-172-31-29-215 sudo:   ubuntu : TTY=pts/0 ; PWD=/recover ; USER=root ; COMMAND=/usr/bin/apt install testdisk -y
Apr 27 11:18:44 ip-172-31-29-215 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Apr 27 11:18:47 ip-172-31-29-215 sudo: pam_unix(sudo:session): session closed for user root
Apr 27 11:19:07 ip-172-31-29-215 sudo:   ubuntu : TTY=pts/0 ; PWD=/recover ; USER=root ; COMMAND=/usr/bin/photorec /dev/xvda1
Apr 27 11:19:07 ip-172-31-29-215 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)
Apr 27 11:19:46 ip-172-31-29-215 sudo: pam_unix(sudo:session): session closed for user root
Apr 27 11:20:01 ip-172-31-29-215 CRON[3850]: pam_unix(cron:session): session opened for user smmsp by (uid=0)
Apr 27 11:20:01 ip-172-31-29-215 CRON[3850]: pam_unix(cron:session): session closed for user smmsp
Apr 27 11:20:16 ip-172-31-29-215 sudo:   ubuntu : TTY=pts/0 ; PWD=/recover ; USER=root ; COMMAND=/usr/bin/photorec /dev/xvda1
Apr 27 11:20:16 ip-172-31-29-215 sudo: pam_unix(sudo:session): session opened for user root by (uid=0)