cron syslog entries since FC4 -> FC6 upgrade.
Styma, Robert E (Robert)
stymar at alcatel-lucent.com
Thu Dec 7 00:38:59 UTC 2006
>
> crond is generated those messages. You should be checking all the
> crontabs that run as root.
>
> On 12/6/06, Styma, Robert E (Robert)
> <stymar at alcatel-lucent.com> wrote:
> >
> > To Those who know syslog well:
> >
> > I upgraded from FC4 -> FC6 via CD's in upgrade
> > mode and now I am getting lots of cron entries
> > in /var/log/secure. Comparisons between the FC4
> > /etc/syslog.conf file and the current copy show
> > it was not updated.
> >
> > I see lots of entries like the following:
> > Dec 6 13:04:01 styma8 crond[29897]:
> pam_unix(crond:session): session opened for user root by (uid=0)
> > Dec 6 13:04:02 styma8 crond[29897]:
> pam_unix(crond:session): session closed for user root
> > Dec 6 13:05:01 styma8 crond[29913]:
> pam_unix(crond:session): session opened for user root by (uid=0)
> > Dec 6 13:05:02 styma8 crond[29913]:
> pam_unix(crond:session): session closed for user root
> >
> > My /etc/syslog.conf file is pretty simple (see below). The
> only thing
> > I am directing to /var/log/secure is authpriv.* which I
> believe is the
> > default. I would prefer to send these cron messages to
> either /var/log/cron
> > or the bit bucket. This leaves /var/log/secure more uncluttered.
> >
> > Can someone suggest a change to /etc/syslog.conf which
> would affect the
> > change I want? Thank you for your time.
> >
> > Bob Styma
> >
> > #----- /etc/syslog.conf
> >
> > # Log all kernel messages to the console.
> > # Logging much else clutters up the screen.
> > #kern.* /dev/console
> >
> > # Log anything (except mail) of level info or higher.
> > # Don't log private authentication messages!
> > *.info;mail.none;authpriv.none;cron.none;auth.!=info
> /var/log/messages
> >
> > # The authpriv file has restricted access.
> > authpriv.*
> /var/log/secure
> >
> > # Log all the mail messages in one place.
> > mail.*
> -/var/log/maillog
> >
> >
> > # Log cron stuff
> > cron.*
> /var/log/cron
> >
> > # Everybody gets emergency messages
> > *.emerg *
> >
> > # Save news errors of level crit and higher in a special file.
> > uucp,news.crit
> /var/log/spooler
> >
> > # Save boot messages also to boot.log
> > local7.*
> /var/log/boot.log
> >
> > auth.=info /var/log/cron
>
> --
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> L. Friedman netllama at gmail.com
> LlamaLand http://netllama.linux-sxs.org
>
I understand that crond is causing the entries to be generated, however
They pass through the syslog process and I want to route them somewhere
less obtrusive. /var/log/security shows when someone attempts to access
my machine. /etc/hosts.allow / deny has so far done it's job, but I like
to keep an eye on this.
Bob
More information about the users
mailing list