Remco Barendse
2005-Aug-18 06:52 UTC
[CentOS] What are these logged events in /var/log/messages
Hi list!
On all my 4.x boxes (didn't see this on 3.x) I get this in
/var/log/messages the whole day:
Aug 17 04:02:05 weblinux1 crond(pam_unix)[32149]: session closed for
user root
Aug 17 05:01:01 weblinux1 crond(pam_unix)[32668]: session opened for
user root b
y (uid=0)
Aug 17 05:01:01 weblinux1 crond(pam_unix)[32668]: session closed for
user root
Aug 17 06:01:01 weblinux1 crond(pam_unix)[32712]: session opened for
user root b
y (uid=0)
Aug 17 06:01:01 weblinux1 crond(pam_unix)[32712]: session closed for
user root
Aug 17 07:01:01 weblinux1 crond(pam_unix)[32762]: session opened for
user root b
y (uid=0)
Aug 17 07:01:01 weblinux1 crond(pam_unix)[32762]: session closed for
user root
Aug 17 08:01:01 weblinux1 crond(pam_unix)[344]: session opened for user
root by
(uid=0)
Logwatch reports it too every day:
crond:
Unknown Entries:
session closed for user root: 25 Time(s)
session opened for user root by (uid=0): 25 Time(s)
Some boxes have up to 770 of these events per day
Ignacio Vazquez-Abrams
2005-Aug-18 07:10 UTC
[CentOS] What are these logged events in /var/log/messages
On Thu, 2005-08-18 at 08:52 +0200, Remco Barendse wrote:> Hi list! > > On all my 4.x boxes (didn't see this on 3.x) I get this in > /var/log/messages the whole day: > > Aug 17 04:02:05 weblinux1 crond(pam_unix)[32149]: session closed for > user root> Some boxes have up to 770 of these events per dayLook in /etc/cron.*. -- Ignacio Vazquez-Abrams <ivazquez at ivazquez.net> http://centos.ivazquez.net/ gpg --keyserver hkp://subkeys.pgp.net --recv-key 38028b72 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part URL: <http://lists.centos.org/pipermail/centos/attachments/20050818/6368a691/attachment-0002.sig>
Remco Barendse
2005-Aug-18 10:39 UTC
[CentOS] What are these logged events in /var/log/messages
On Thu, 18 Aug 2005, Ignacio Vazquez-Abrams wrote:> On Thu, 2005-08-18 at 08:52 +0200, Remco Barendse wrote: >> Hi list! >> >> On all my 4.x boxes (didn't see this on 3.x) I get this in >> /var/log/messages the whole day: >> >> Aug 17 04:02:05 weblinux1 crond(pam_unix)[32149]: session closed for >> user root > >> Some boxes have up to 770 of these events per day > > Look in /etc/cron.*. >OK, so I guess that for every cron job that is run as root such an event is written to /var/log/messages? Strange that it doesn't report which cronjob it has processed, the report as it is now is rather useless for any use. Can I disable those messages?
Reasonably Related Threads
- smbd crash
- hourly log
- Re: ocfs2 and configfs.ko..fixed...but gnuparted has issues....fixed gnuparted...but mount -t ocfs2 fails...
- Re: ocfs2 and configfs.ko..fixed...but gnuparted has issues....fixed gnuparted...but mount -t ocfs2 fails...
- Occasional faults - CentOS server running subversion