cron "unusual event"
Hey Guys,
I was wondering what may be causing my logcheck to report every time a
cron session is opened / closed via root. The weird thing is that root has
no user crontab file. Would this be talking about /etc/crontab and
cron.daily / monthly ? I'm not sure what else it could be.
Give the Ghost some love!
Any advice appriciated.
D. Ghost
Unusual System Events
=-=-=-=-=-=-=-=-=-=-=
Nov 24 22:02:01 ghost PAM_unix[12478]: (cron) session closed for user root
Nov 24 22:05:01 ghost PAM_unix[12507]: (cron) session opened for user root
by
(uid=0)
Nov 24 22:05:02 ghost PAM_unix[12507]: (cron) session closed for user root
Nov 24 22:08:01 ghost PAM_unix[12513]: (cron) session opened for user mail
by
(uid=0)
Nov 24 22:08:01 ghost PAM_unix[12513]: (cron) session closed for user mail
Nov 24 22:10:01 ghost PAM_unix[12519]: (cron) session opened for user root
by
(uid=0)
Nov 24 22:10:02 ghost PAM_unix[12519]: (cron) session closed for user root
Nov 24 22:15:01 ghost PAM_unix[12522]: (cron) session opened for user root
by
(uid=0)
Nov 24 22:15:01 ghost PAM_unix[12522]: (cron) session closed for user root
Nov 24 22:20:01 ghost PAM_unix[12525]: (cron) session opened for user root
by
(uid=0)
Nov 24 22:20:02 ghost PAM_unix[12525]: (cron) session closed for user root
Nov 24 22:25:01 ghost PAM_unix[12531]: (cron) session opened for user root
by
(uid=0)
Nov 24 22:25:01 ghost PAM_unix[12531]: (cron) session closed for user root
Nov 24 22:30:01 ghost PAM_unix[12534]: (cron) session opened for user root
by
(uid=0)
Nov 24 22:30:02 ghost PAM_unix[12534]: (cron) session closed for user root
Nov 24 22:35:01 ghost PAM_unix[12537]: (cron) session opened for user root
by
(uid=0)
Nov 24 22:35:02 ghost PAM_unix[12537]: (cron) session closed for user root
Nov 24 22:38:01 ghost PAM_unix[12543]: (cron) session opened for user mail
by
(uid=0)
Nov 24 22:38:01 ghost PAM_unix[12543]: (cron) session closed for user mail
Nov 24 22:40:01 ghost PAM_unix[12546]: (cron) session opened for user root
by
(uid=0)
Nov 24 22:40:01 ghost PAM_unix[12546]: (cron) session closed for user root
Nov 24 22:45:01 ghost PAM_unix[12552]: (cron) session opened for user root
by
(uid=0)
Nov 24 22:45:02 ghost PAM_unix[12552]: (cron) session closed for user root
Nov 24 22:50:01 ghost PAM_unix[12556]: (cron) session opened for user root
by
Reply to: