Topic: session opened for user root by (uid=0)

[rmoria]

In my message log I see a lot of these.

Jul 25 03:25:01 servername crond(pam_unix)[19510]: session opened for user root by (uid=0)
Jul 25 03:25:02 servername crond(pam_unix)[19510]: session closed for user root

Password is secure (and I have changed it to test if it had been compromised). ssh is disabled.

If I do a search I see more people with this problem. Does anyone have a clue where this comes from?

[cactus]

In my message log I see a lot of these.

Jul 25 03:25:01 servername crond(pam_unix)[19510]: session opened for user root by (uid=0)
Jul 25 03:25:02 servername crond(pam_unix)[19510]: session closed for user root

Password is secure (and I have changed it to test if it had been compromised). ssh is disabled.

If I do a search I see more people with this problem. Does anyone have a clue where this comes from?

Could it be that one of your cron jobs is running as user root?

[rmoria]

It also happens at times where there are no custom cron-jobs.

Code: [Select]

Jul 25 10:55:02 nathan crond(pam_unix)[12668]: session opened for user root by (uid=0)
Jul 25 10:55:07 nathan crond(pam_unix)[12668]: session closed for user root

My cron jobs end around 04:00:00

[JonB]

rmoria,

It's just log noise. Check the cron logs. It will tell you what is being run at what time and by what user.

I would suspect that you either have sme7admin or sysmon installed. cron runs sa1 (sysstat) every 5 minutes.

I notice that after doing the latest sme-testing updates, the crond entries in the messages log have disappeared.

Jon

[rmoria]

Thanks, I do have sme7admin installed.
I'll just try to ignore the entries (or install the sme-test updates)