Security :: Possible To Map Httpd Sealert To Its Access Log?

One of our web servers has logged many of the same "setroubleshoot: SELinux is preventing the httpd from using potentially mislabeled files /boot (boot_t). For complete SELinux messages. run sealert -l e143c369-a72d-453e-84fe-6b62b7f05c5f" recently. This looks suspicious. We'd like to map these sealert to the httpd access log to see if there's any malicious activity. We added a '%P' option to the Apache combined logformat, so the httpd process id could be logged too. Then we grep'ed all the Apache access logs using the pid from the above sealert -l command. There are not many of them, so we can test them one by one.

Shockingly, none of the access served by the specified pid can repeat the same sealert.

The server was installed a Centos 5 (x86_64) and upgraded to the 5.3 version two days ago. The main components are as following:

Is there any other way we can try to find out the real access which triggered these alerts? The sealert -l output is attached.