my log files-is there any problem
sbathe at gmail.com
Fri May 13 06:10:33 UTC 2005
Ankush Grover wrote:
> Here is my log file which is generated by Logwatch .
> Unknown Entries:
> session closed for user root: 313 Time(s)
> session opened for user root by (uid=0): 313 Time(s)
> From unknown[22.214.171.124] to support at microsoft.com : 1 Time(s)
> From unknown[126.96.36.199] to smtphunter44 at daum.net : 1 Time(s)
>I am little concerned with these 2 means are these the normal entries
>or there is some problem.As it can be seen that cron daemon opened for
>root 313 times isn't it too much.
>Please tell me about this.
>Thanks & Regards
Check /var/log/cron to see what cron job is running. Jobs like sa
(systat) generally run every 10 minutes as root. So these might be usual.
For the sendmail logs, nothing much to worry as a relaying attempt was
denied. If this is a public facing server running sendmail, these
entries might be pretty common atleast in India.
But if you are really worried, cheking the actual logs might give more
insights to the problem
More information about the users