Root session opened every 3 minutes
Alexander Apprich
A.Apprich at science-computing.de
Thu Nov 4 09:54:48 UTC 2004
Neil,
Neil Marjoram wrote:
> I am a bit concerned about what appears to be a login every three
> minutes on my server. Can anyone help with this? Heres a bit of my log
> :(host is the servers hostname)
>
> Nov 4 08:17:54 host sshd(pam_unix)[2945]: session opened for user root
> by (uid=0)
> Nov 4 08:17:55 host sshd(pam_unix)[2945]: session closed for user root
> Nov 4 08:20:55 host sshd(pam_unix)[2991]: session opened for user root
> by (uid=0)
> Nov 4 08:20:55 host sshd(pam_unix)[2991]: session closed for user root
> Nov 4 08:23:56 host sshd(pam_unix)[3035]: session opened for user root
> by (uid=0)
> Nov 4 08:23:56 host sshd(pam_unix)[3035]: session closed for user root
> Nov 4 08:26:56 host sshd(pam_unix)[3205]: session opened for user root
> by (uid=0)
> Nov 4 08:26:57 host sshd(pam_unix)[3205]: session closed for user root
> Nov 4 08:29:57 host sshd(pam_unix)[3249]: session opened for user root
> by (uid=0)
> Nov 4 08:29:57 host sshd(pam_unix)[3249]: session closed for user root
>
Do you have any kind of monitoring tool (e.g. nagios) running on that
server that checks the exitens of your sshd? We have nagios running here
and my logfile is packed w/those messages.
> Thanks,
>
> Neil.
Just a best gues.
Alex
More information about the users
mailing list