Hey Guys, I was wondering what may be causing my logcheck to report every time a cron session is opened / closed via root. The weird thing is that root has no user crontab file. Would this be talking about /etc/crontab and cron.daily / monthly ? I'm not sure what else it could be.
Give the Ghost some love! Any advice appriciated. D. Ghost Unusual System Events =-=-=-=-=-=-=-=-=-=-= Nov 24 22:02:01 ghost PAM_unix[12478]: (cron) session closed for user root Nov 24 22:05:01 ghost PAM_unix[12507]: (cron) session opened for user root by (uid=0) Nov 24 22:05:02 ghost PAM_unix[12507]: (cron) session closed for user root Nov 24 22:08:01 ghost PAM_unix[12513]: (cron) session opened for user mail by (uid=0) Nov 24 22:08:01 ghost PAM_unix[12513]: (cron) session closed for user mail Nov 24 22:10:01 ghost PAM_unix[12519]: (cron) session opened for user root by (uid=0) Nov 24 22:10:02 ghost PAM_unix[12519]: (cron) session closed for user root Nov 24 22:15:01 ghost PAM_unix[12522]: (cron) session opened for user root by (uid=0) Nov 24 22:15:01 ghost PAM_unix[12522]: (cron) session closed for user root Nov 24 22:20:01 ghost PAM_unix[12525]: (cron) session opened for user root by (uid=0) Nov 24 22:20:02 ghost PAM_unix[12525]: (cron) session closed for user root Nov 24 22:25:01 ghost PAM_unix[12531]: (cron) session opened for user root by (uid=0) Nov 24 22:25:01 ghost PAM_unix[12531]: (cron) session closed for user root Nov 24 22:30:01 ghost PAM_unix[12534]: (cron) session opened for user root by (uid=0) Nov 24 22:30:02 ghost PAM_unix[12534]: (cron) session closed for user root Nov 24 22:35:01 ghost PAM_unix[12537]: (cron) session opened for user root by (uid=0) Nov 24 22:35:02 ghost PAM_unix[12537]: (cron) session closed for user root Nov 24 22:38:01 ghost PAM_unix[12543]: (cron) session opened for user mail by (uid=0) Nov 24 22:38:01 ghost PAM_unix[12543]: (cron) session closed for user mail Nov 24 22:40:01 ghost PAM_unix[12546]: (cron) session opened for user root by (uid=0) Nov 24 22:40:01 ghost PAM_unix[12546]: (cron) session closed for user root Nov 24 22:45:01 ghost PAM_unix[12552]: (cron) session opened for user root by (uid=0) Nov 24 22:45:02 ghost PAM_unix[12552]: (cron) session closed for user root Nov 24 22:50:01 ghost PAM_unix[12556]: (cron) session opened for user root by
