_CRONJOB_ appears at the end of TCP outbound audit log.
14 Jun 2018 09:49:24 P TCP telnet 408 3 host /usr/lib/systemd/systemd _CRONJOB_
This also happens on ftp.
This only happens after login by user who is not defined in PIM database, and the terminal from where the user logs in appear in TCP outbound audit log.
This happens because the terminal of undefined user login information is wrongly taken for TCP outbound audit log.
If cron login is done by undefined user, TCP outbound audit log shows _CRONJOB_ at the end as the terminal of cron login is _CRONJOB_.
PIM 12.8 SP1 / RHEL 7.5
This is fixed by testfix T52V317 (for Linux x64).
Please contact CA Support for testfix.