# ausearch -m USER_LOGIN
----
time->Sat Jun 28 20:14:10 2014
type=USER_LOGIN msg=audit(1403979250.412:116733): pid=31587 uid=0 auid=1000
  ses=1445 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=1000
  exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=/dev/pts/9 res=success'