Remco Barendse
2005-Aug-18 06:52 UTC
[CentOS] What are these logged events in /var/log/messages
Hi list! On all my 4.x boxes (didn't see this on 3.x) I get this in /var/log/messages the whole day: Aug 17 04:02:05 weblinux1 crond(pam_unix)[32149]: session closed for user root Aug 17 05:01:01 weblinux1 crond(pam_unix)[32668]: session opened for user root b y (uid=0) Aug 17 05:01:01 weblinux1 crond(pam_unix)[32668]: session closed for user root Aug 17 06:01:01 weblinux1 crond(pam_unix)[32712]: session opened for user root b y (uid=0) Aug 17 06:01:01 weblinux1 crond(pam_unix)[32712]: session closed for user root Aug 17 07:01:01 weblinux1 crond(pam_unix)[32762]: session opened for user root b y (uid=0) Aug 17 07:01:01 weblinux1 crond(pam_unix)[32762]: session closed for user root Aug 17 08:01:01 weblinux1 crond(pam_unix)[344]: session opened for user root by (uid=0) Logwatch reports it too every day: crond: Unknown Entries: session closed for user root: 25 Time(s) session opened for user root by (uid=0): 25 Time(s) Some boxes have up to 770 of these events per day
Ignacio Vazquez-Abrams
2005-Aug-18 07:10 UTC
[CentOS] What are these logged events in /var/log/messages
On Thu, 2005-08-18 at 08:52 +0200, Remco Barendse wrote:> Hi list! > > On all my 4.x boxes (didn't see this on 3.x) I get this in > /var/log/messages the whole day: > > Aug 17 04:02:05 weblinux1 crond(pam_unix)[32149]: session closed for > user root> Some boxes have up to 770 of these events per dayLook in /etc/cron.*. -- Ignacio Vazquez-Abrams <ivazquez at ivazquez.net> http://centos.ivazquez.net/ gpg --keyserver hkp://subkeys.pgp.net --recv-key 38028b72 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part URL: <http://lists.centos.org/pipermail/centos/attachments/20050818/6368a691/attachment-0002.sig>
Remco Barendse
2005-Aug-18 10:39 UTC
[CentOS] What are these logged events in /var/log/messages
On Thu, 18 Aug 2005, Ignacio Vazquez-Abrams wrote:> On Thu, 2005-08-18 at 08:52 +0200, Remco Barendse wrote: >> Hi list! >> >> On all my 4.x boxes (didn't see this on 3.x) I get this in >> /var/log/messages the whole day: >> >> Aug 17 04:02:05 weblinux1 crond(pam_unix)[32149]: session closed for >> user root > >> Some boxes have up to 770 of these events per day > > Look in /etc/cron.*. >OK, so I guess that for every cron job that is run as root such an event is written to /var/log/messages? Strange that it doesn't report which cronjob it has processed, the report as it is now is rather useless for any use. Can I disable those messages?
Reasonably Related Threads
- smbd crash
- hourly log
- Re: ocfs2 and configfs.ko..fixed...but gnuparted has issues....fixed gnuparted...but mount -t ocfs2 fails...
- Re: ocfs2 and configfs.ko..fixed...but gnuparted has issues....fixed gnuparted...but mount -t ocfs2 fails...
- Occasional faults - CentOS server running subversion