Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm seeing a huge amount of these lines in my auth logs:

Dec 31 03:45:01 xxxxxxx CRON[17259]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 03:45:01 xxxxxxx CRON[17259]: pam_unix(cron:session): session closed for user root
Dec 31 03:55:01 xxxxxxx CRON[17317]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 03:55:01 xxxxxxx CRON[17317]: pam_unix(cron:session): session closed for user root
Dec 31 04:05:01 xxxxxxx CRON[17375]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 04:05:01 xxxxxxx CRON[17375]: pam_unix(cron:session): session closed for user root
Dec 31 04:15:01 xxxxxxx CRON[17434]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 04:15:01 xxxxxxx CRON[17434]: pam_unix(cron:session): session closed for user root
Dec 31 04:17:01 xxxxxxx CRON[17438]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 04:17:01 xxxxxxx CRON[17438]: pam_unix(cron:session): session closed for user root
Dec 31 04:25:01 xxxxxxx CRON[17498]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 04:25:01 xxxxxxx CRON[17498]: pam_unix(cron:session): session closed for user root
Dec 31 04:35:01 xxxxxxx CRON[17596]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 04:35:01 xxxxxxx CRON[17596]: pam_unix(cron:session): session closed for user root
Dec 31 04:45:01 xxxxxxx CRON[17669]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 04:45:01 xxxxxxx CRON[17669]: pam_unix(cron:session): session closed for user root
Dec 31 04:55:01 xxxxxxx CRON[17730]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 04:55:01 xxxxxxx CRON[17730]: pam_unix(cron:session): session closed for user root
Dec 31 05:05:01 xxxxxxx CRON[17788]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 05:05:01 xxxxxxx CRON[17788]: pam_unix(cron:session): session closed for user root
Dec 31 05:15:01 xxxxxxx CRON[17857]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 05:15:01 xxxxxxx CRON[17857]: pam_unix(cron:session): session closed for user root
Dec 31 05:17:01 xxxxxxx CRON[17861]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 05:17:01 xxxxxxx CRON[17861]: pam_unix(cron:session): session closed for user root
Dec 31 05:25:01 xxxxxxx CRON[17917]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 05:25:02 xxxxxxx CRON[17917]: pam_unix(cron:session): session closed for user root
Dec 31 05:35:01 xxxxxxx CRON[17975]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 05:35:01 xxxxxxx CRON[17975]: pam_unix(cron:session): session closed for user root
Dec 31 05:45:01 xxxxxxx CRON[18015]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 05:45:01 xxxxxxx CRON[18015]: pam_unix(cron:session): session closed for user root
Dec 31 05:55:01 xxxxxxx CRON[18072]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 05:55:01 xxxxxxx CRON[18072]: pam_unix(cron:session): session closed for user root
Dec 31 06:05:01 xxxxxxx CRON[18130]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 06:05:01 xxxxxxx CRON[18130]: pam_unix(cron:session): session closed for user root
Dec 31 06:15:01 xxxxxxx CRON[18201]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 06:15:01 xxxxxxx CRON[18201]: pam_unix(cron:session): session closed for user root
Dec 31 06:17:01 xxxxxxx CRON[18229]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 06:17:01 xxxxxxx CRON[18229]: pam_unix(cron:session): session closed for user root
Dec 31 06:25:01 xxxxxxx CRON[18262]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 06:25:01 xxxxxxx CRON[18263]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 06:25:01 xxxxxxx CRON[18263]: pam_unix(cron:session): session closed for user root
Dec 31 06:35:01 xxxxxxx CRON[18357]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 06:35:01 xxxxxxx CRON[18357]: pam_unix(cron:session): session closed for user root
Dec 31 06:43:31 xxxxxxx CRON[18262]: pam_unix(cron:session): session closed for user root
Dec 31 06:45:01 xxxxxxx CRON[18596]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 06:45:01 xxxxxxx CRON[18596]: pam_unix(cron:session): session closed for user root
Dec 31 06:55:01 xxxxxxx CRON[18660]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 06:55:01 xxxxxxx CRON[18660]: pam_unix(cron:session): session closed for user root
Dec 31 07:05:01 xxxxxxx CRON[18717]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 07:05:01 xxxxxxx CRON[18717]: pam_unix(cron:session): session closed for user root
Dec 31 07:15:01 xxxxxxx CRON[18776]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 07:15:01 xxxxxxx CRON[18776]: pam_unix(cron:session): session closed for user root
Dec 31 07:17:01 xxxxxxx CRON[18781]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 07:17:01 xxxxxxx CRON[18781]: pam_unix(cron:session): session closed for user root
Dec 31 07:25:01 xxxxxxx CRON[18841]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 07:25:01 xxxxxxx CRON[18841]: pam_unix(cron:session): session closed for user root
Dec 31 07:35:01 xxxxxxx CRON[18898]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 07:35:01 xxxxxxx CRON[18898]: pam_unix(cron:session): session closed for user root
Dec 31 07:45:01 xxxxxxx CRON[18981]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 07:45:01 xxxxxxx CRON[18981]: pam_unix(cron:session): session closed for user root
Dec 31 07:55:01 xxxxxxx CRON[19043]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 07:55:01 xxxxxxx CRON[19043]: pam_unix(cron:session): session closed for user root
Dec 31 08:05:01 xxxxxxx CRON[19100]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 08:05:01 xxxxxxx CRON[19100]: pam_unix(cron:session): session closed for user root
Dec 31 08:15:01 xxxxxxx CRON[19164]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 08:15:01 xxxxxxx CRON[19164]: pam_unix(cron:session): session closed for user root
Dec 31 08:17:01 xxxxxxx CRON[19169]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 08:17:01 xxxxxxx CRON[19169]: pam_unix(cron:session): session closed for user root
Dec 31 08:25:01 xxxxxxx CRON[19229]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 08:25:01 xxxxxxx CRON[19229]: pam_unix(cron:session): session closed for user root
Dec 31 08:35:01 xxxxxxx CRON[19314]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 08:35:01 xxxxxxx CRON[19314]: pam_unix(cron:session): session closed for user root
Dec 31 08:45:01 xxxxxxx CRON[19412]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 08:45:01 xxxxxxx CRON[19412]: pam_unix(cron:session): session closed for user root
Dec 31 08:55:01 xxxxxxx CRON[19472]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 08:55:01 xxxxxxx CRON[19472]: pam_unix(cron:session): session closed for user root
Dec 31 09:05:01 xxxxxxx CRON[19537]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 09:05:01 xxxxxxx CRON[19537]: pam_unix(cron:session): session closed for user root
Dec 31 09:15:01 xxxxxxx CRON[19581]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 09:15:01 xxxxxxx CRON[19581]: pam_unix(cron:session): session closed for user root
Dec 31 09:17:01 xxxxxxx CRON[19608]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 09:17:01 xxxxxxx CRON[19608]: pam_unix(cron:session): session closed for user root
Dec 31 09:25:01 xxxxxxx CRON[19641]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 09:25:01 xxxxxxx CRON[19641]: pam_unix(cron:session): session closed for user root
Dec 31 09:35:01 xxxxxxx CRON[19707]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 09:35:01 xxxxxxx CRON[19707]: pam_unix(cron:session): session closed for user root
Dec 31 09:45:01 xxxxxxx CRON[19766]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 09:45:01 xxxxxxx CRON[19766]: pam_unix(cron:session): session closed for user root
Dec 31 09:55:01 xxxxxxx CRON[19827]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 09:55:01 xxxxxxx CRON[19827]: pam_unix(cron:session): session closed for user root
Dec 31 10:05:01 xxxxxxx CRON[19889]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 10:05:01 xxxxxxx CRON[19889]: pam_unix(cron:session): session closed for user root
Dec 31 10:15:01 xxxxxxx CRON[19948]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 10:15:01 xxxxxxx CRON[19948]: pam_unix(cron:session): session closed for user root
Dec 31 10:17:01 xxxxxxx CRON[19976]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 10:17:01 xxxxxxx CRON[19976]: pam_unix(cron:session): session closed for user root
Dec 31 10:25:01 xxxxxxx CRON[20010]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 10:25:01 xxxxxxx CRON[20010]: pam_unix(cron:session): session closed for user root
Dec 31 10:35:01 xxxxxxx CRON[20068]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 10:35:01 xxxxxxx CRON[20068]: pam_unix(cron:session): session closed for user root
Dec 31 10:45:01 xxxxxxx CRON[20126]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 10:45:01 xxxxxxx CRON[20126]: pam_unix(cron:session): session closed for user root
Dec 31 10:55:01 xxxxxxx CRON[20184]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 10:55:01 xxxxxxx CRON[20184]: pam_unix(cron:session): session closed for user root
Dec 31 11:05:01 xxxxxxx CRON[20242]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 11:05:01 xxxxxxx CRON[20242]: pam_unix(cron:session): session closed for user root
Dec 31 11:15:01 xxxxxxx CRON[20355]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 11:15:01 xxxxxxx CRON[20355]: pam_unix(cron:session): session closed for user root
Dec 31 11:17:01 xxxxxxx CRON[20368]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 11:17:01 xxxxxxx CRON[20368]: pam_unix(cron:session): session closed for user root
Dec 31 11:25:01 xxxxxxx CRON[20424]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 11:25:01 xxxxxxx CRON[20424]: pam_unix(cron:session): session closed for user root
Dec 31 11:35:01 xxxxxxx CRON[20482]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 11:35:01 xxxxxxx CRON[20482]: pam_unix(cron:session): session closed for user root
Dec 31 11:45:01 xxxxxxx CRON[20540]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 11:45:01 xxxxxxx CRON[20540]: pam_unix(cron:session): session closed for user root
Dec 31 11:55:01 xxxxxxx CRON[20610]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 11:55:01 xxxxxxx CRON[20610]: pam_unix(cron:session): session closed for user root
Dec 31 12:05:01 xxxxxxx CRON[20672]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 12:05:01 xxxxxxx CRON[20672]: pam_unix(cron:session): session closed for user root
Dec 31 12:15:01 xxxxxxx CRON[20738]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 12:15:01 xxxxxxx CRON[20738]: pam_unix(cron:session): session closed for user root
Dec 31 12:17:01 xxxxxxx CRON[20747]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 12:17:01 xxxxxxx CRON[20747]: pam_unix(cron:session): session closed for user root
Dec 31 12:25:01 xxxxxxx CRON[20811]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 12:25:01 xxxxxxx CRON[20811]: pam_unix(cron:session): session closed for user root
Dec 31 12:35:01 xxxxxxx CRON[20873]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 12:35:01 xxxxxxx CRON[20873]: pam_unix(cron:session): session closed for user root
Dec 31 12:45:02 xxxxxxx CRON[20935]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 12:45:02 xxxxxxx CRON[20935]: pam_unix(cron:session): session closed for user root
Dec 31 12:55:01 xxxxxxx CRON[20984]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 12:55:02 xxxxxxx CRON[20984]: pam_unix(cron:session): session closed for user root
Dec 31 13:05:01 xxxxxxx CRON[21042]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 13:05:01 xxxxxxx CRON[21042]: pam_unix(cron:session): session closed for user root
Dec 31 13:15:01 xxxxxxx CRON[21212]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 13:15:01 xxxxxxx CRON[21212]: pam_unix(cron:session): session closed for user root
Dec 31 13:17:01 xxxxxxx CRON[21240]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 13:17:01 xxxxxxx CRON[21240]: pam_unix(cron:session): session closed for user root
Dec 31 13:25:01 xxxxxxx CRON[21299]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 13:25:01 xxxxxxx CRON[21299]: pam_unix(cron:session): session closed for user root
Dec 31 13:35:01 xxxxxxx CRON[21378]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 13:35:01 xxxxxxx CRON[21378]: pam_unix(cron:session): session closed for user root
Dec 31 13:45:01 xxxxxxx CRON[21439]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 13:45:01 xxxxxxx CRON[21439]: pam_unix(cron:session): session closed for user root
Dec 31 13:55:01 xxxxxxx CRON[21497]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 13:55:01 xxxxxxx CRON[21497]: pam_unix(cron:session): session closed for user root
Dec 31 14:05:01 xxxxxxx CRON[21561]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 14:05:01 xxxxxxx CRON[21561]: pam_unix(cron:session): session closed for user root
Dec 31 14:15:01 xxxxxxx CRON[21631]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 14:15:01 xxxxxxx CRON[21631]: pam_unix(cron:session): session closed for user root
Dec 31 14:17:01 xxxxxxx CRON[21657]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec 31 14:17:01 xxxxxxx CRON[21657]: pam_unix(cron:session): session closed for user root

Here's my crontab:

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

# cron to backup all the databases in 1 gzipped file every midnight
0 0     * * *   root    bash /home/db_backup.sh > /dev/null 2>&1

# cron to update CloudFlare list of IPs for set_real_ip_from (nginx)
0 21    * * 0  root bash /etc/nginx/cloudflare-ips.sh > /dev/null 2>&1

There's nothing to be executed every 2, 5 or 10 minutes (Dec 31 12:05, Dec 31 12:15, Dec 31 12:17, ...)! What can cause these sessions to be opened and closed all these times (in a small time interval)?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

That looks like /etc/crontab on an Ubuntu system.

  • What about root's crontab /var/spool/cron/crontabs/root (crontab -e as root).

  • What about the contents of /etc/cron.d (which will probably be most revealing)

share|improve this answer
    
Yep it's an Ubuntu server. /var/spool/cron/crontabs/root is empty. In cron.d there are 2 files, one is sysstat (here's the content pastebin.com/77SxXh0G), the other is .placeholder (empty). –  MultiformeIngegno Dec 31 '12 at 13:44
    
Oh probably is this: "# Activity reports every 10 minutes everyday". What's that exactly? –  MultiformeIngegno Dec 31 '12 at 13:44
    
Ok I searched a bit and it's sysstat. I didn't remember installing it. Anyway, I commented every line in cron.d/sysstat and restarted cron. –  MultiformeIngegno Dec 31 '12 at 13:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.