Hi list!
On all my 4.x boxes (didn't see this on 3.x) I get this in
/var/log/messages the whole day:
Aug 17 04:02:05 weblinux1 crond(pam_unix)[32149]: session closed for
user root
Aug 17 05:01:01 weblinux1 crond(pam_unix)[32668]: session opened for
user root b
y (uid=0)
Aug 17 05:01:01 weblinux1 crond(pam_unix)[32668]: session closed for
user root
Aug 17 06:01:01 weblinux1 crond(pam_unix)[32712]: session opened for
user root b
y (uid=0)
Aug 17 06:01:01 weblinux1 crond(pam_unix)[32712]: session closed for
user root
Aug 17 07:01:01 weblinux1 crond(pam_unix)[32762]: session opened for
user root b
y (uid=0)
Aug 17 07:01:01 weblinux1 crond(pam_unix)[32762]: session closed for
user root
Aug 17 08:01:01 weblinux1 crond(pam_unix)[344]: session opened for user
root by
(uid=0)
Logwatch reports it too every day:
crond:
Unknown Entries:
session closed for user root: 25 Time(s)
session opened for user root by (uid=0): 25 Time(s)
Some boxes have up to 770 of these events per day
