auid=4294967295 issue

Hi Steve, thanks for your assistance, [root@test /root]# cat /proc/cmdline ro root=LABEL=/ audit=1 rhgb quiet [root@test /root]# cat /proc/self/loginuid 0 To narrow the circle; we have some linux servers and a central log collector system. we are sending audit logs to this log system. this log collector system can parse such logs but this system confused at lines with "auid=4294967295" in audit logs. i have tried everything but still this lines are coming: type=USER_ACCT msg=audit(1420656001.965:2804): user pid=6083 uid=0 auid=4294967295 msg='PAM: accounting acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' type=CRED_ACQ msg=audit(1420656001.966:2805): user pid=6083 uid=0 auid=4294967295 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' and [root@test /root]# cat /etc/pam.d/crond # # The PAM configuration file for the cron daemon # # session required pam_loginuid.so auth required pam_unix.so auth required pam_nologin.so account required pam_unix.so password required pam_unix.so session required pam_unix.so so is there any other hints or what can i do esle?