Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is an odd one and I know that the answer will be something simple that I have over looked... I have inherited responsibility for a Linux server running an old version of Ubuntu 10.04, it has a backup scrip running every hour but I can't find out where it's running from.

In the auth logs I see an entry every hour corresponding exactly to the time the backup is fired suggesting that this is a cron job:

"pam_unix(cron:session): session opened for user root"

It is not a remote command over SSH as there is no SSH session entry preceding it.

I have run the following command to list all user's cron jobs, which produces no results for anyone:

"for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l; done"

It's not anacron either... What else is there? Any suggestions on where I might look next? I am thinking potentially there is a GUI app and the auth log entry is misleading.

Thanks in advance

share|improve this question
Try also /etc/cron.d/*, /etc/cron.hourly, /etc/crontab. –  MadHatter Dec 19 '13 at 9:20
add comment

1 Answer

The message comes from PAM which is consulted every time a shell is spawned. See contents of /etc/pam.d, especially files /etc/pam.d/common-session and /etc/pam.d/cron.

This message means that there is indeed a cronjob somewhere which is run by the root user. That does not mean the job is doing anything (it might, for example, just check if a certain logfile is big enough to be rotated and exit without rotating it).

Definitions of cronjobs are spread over several directories and files. For the root user you should take a look into file /etc/crontab, output of crontab -l -u root and contents of directories /etc/cron.hourly, /etc/cron.daily, /etc/cron.weekly, /etc/cron.monthly and /etc/cron.d. The last one contains traditional cronjob definition tables whereas all the other directories contain executable scripts or binaries which are run by the cron with a period mentioned in the directory name (for more information see man run-parts).

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.