Oki DZ <[EMAIL PROTECTED]> writes: > Hi, > > I have quite many of the following lines in auth.log. > bdg:/var/log# tail auth.log > May 22 12:55:02 bdg PAM_unix[1477]: (cron) session closed for user root > May 22 12:55:02 bdg PAM_unix[1476]: (cron) session closed for user root > May 22 13:00:01 bdg PAM_unix[1536]: (cron) session opened for user > root by (uid=0) > May 22 13:00:02 bdg PAM_unix[1536]: (cron) session closed for user root > May 22 13:05:01 bdg PAM_unix[1597]: (cron) session opened for user > root by (uid=0) > May 22 13:05:01 bdg PAM_unix[1596]: (cron) session opened for user > root by (uid=0) > May 22 13:05:01 bdg PAM_unix[1597]: (cron) session closed for user root > May 22 13:05:02 bdg PAM_unix[1596]: (cron) session closed for user root > May 22 13:10:01 bdg PAM_unix[1633]: (cron) session opened for user > root by (uid=0) > May 22 13:10:01 bdg PAM_unix[1633]: (cron) session closed for user root > > Does it mean that somebody has been trying to log in?
Looks like you have a cron job running every five minutes. As I don't recall anything out of the box that does this, it's probably something you configured yourself. I'd guess a mail-transfer-agent. Check /etc/crontab and /etc/cron.d/* for culprits. -- Olaf Meeuwissen Epson Kowa Corporation, CID GnuPG key: 6BE37D90/AB6B 0D1F 99E7 1BF5 EB97 976A 16C7 F27D 6BE3 7D90 LPIC-2 -- I hack, therefore I am -- BOFH -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]