massig session opened/closed logs in auth.log, scheinbar von cron
hallo,
ich habe endlos viele einträge in auth.log, die auf einen lokalen login
und anschließenden logout, vom CRON prozess ausgeführt, als user root
schließen lassen.
ehrlich gesagt wunder mich das schon, weil ich nicht wüßte, welcher
cronjob etwas (zb. mit su, sudo, etc) als root ausführt, schon garnicht
alle 5 minuten, in diesem abstand kommen immer so zwischen einem und
fünf logins:
--- SNIP /var/log/auth.log ---
Sep 12 04:02:01 diana50 CRON[7881]: (pam_unix) session opened for user logcheck by (uid=0)
Sep 12 04:02:08 diana50 CRON[7881]: (pam_unix) session closed for user logcheck
Sep 12 04:05:01 diana50 CRON[8396]: (pam_unix) session opened for user root by (uid=0)
Sep 12 04:05:01 diana50 CRON[8397]: (pam_unix) session opened for user root by (uid=0)
Sep 12 04:05:01 diana50 CRON[8398]: (pam_unix) session opened for user root by (uid=0)
Sep 12 04:05:02 diana50 CRON[8396]: (pam_unix) session closed for user root
Sep 12 04:05:02 diana50 CRON[8397]: (pam_unix) session closed for user root
Sep 12 04:05:02 diana50 CRON[8398]: (pam_unix) session closed for user root
Sep 12 04:09:01 diana50 CRON[8412]: (pam_unix) session opened for user root by (uid=0)
Sep 12 04:09:01 diana50 CRON[8412]: (pam_unix) session closed for user root
Sep 12 04:10:01 diana50 CRON[8421]: (pam_unix) session opened for user root by (uid=0)
Sep 12 04:10:01 diana50 CRON[8422]: (pam_unix) session opened for user root by (uid=0)
Sep 12 04:10:01 diana50 CRON[8423]: (pam_unix) session opened for user root by (uid=0)
Sep 12 04:10:01 diana50 CRON[8424]: (pam_unix) session opened for user root by (uid=0)
Sep 12 04:10:01 diana50 CRON[8421]: (pam_unix) session closed for user root
Sep 12 04:10:02 diana50 CRON[8422]: (pam_unix) session closed for user root
Sep 12 04:10:02 diana50 CRON[8423]: (pam_unix) session closed for user root
Sep 12 04:10:02 diana50 CRON[8424]: (pam_unix) session closed for user root
--- SNIP ---
hat jemand eine idee, was das sein könnte?
bye
jonas
Reply to: