LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 10-22-2005, 03:05 AM   #1
a1tair
LQ Newbie
 
Registered: Oct 2005
Location: sg
Distribution: Ubuntu
Posts: 29

Rep: Reputation: 15
Constant crond log error recorded


Hi guys,
I realize there have been constant disk activity even when i am not doing anything thus i decided to direct my /var/log/crond to tty8 and realize every 5 min it is throwing this error.... Do you guys know how i can go about fixing it.

Thanks in advance.

----------------------------------------
Sep 19 00:40:01 localhost crond[8282]: (root) CMD (/usr/lib/sa/sa1 1 1)
Sep 19 00:45:01 localhost crond[8341]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --confcache-file /var/lib/mrtg/mrtg.ok)
Sep 19 00:50:01 localhost crond[8391]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --confcache-file /var/lib/mrtg/mrtg.ok)

----------------------------------------
and of course i get a lot of these from /var/log/messages

Oct 3 05:00:01 localhost crond(pam_unix)[7864]: session opened for user root by (uid=0)
Oct 3 05:00:01 localhost crond(pam_unix)[7866]: session opened for user root by (uid=0)
Oct 3 05:00:02 localhost crond(pam_unix)[7866]: session closed for user root
Oct 3 05:00:02 localhost crond(pam_unix)[7864]: session closed for user root
 
Old 10-22-2005, 05:40 AM   #2
trickykid
Guru
 
Registered: Jan 2001
Posts: 24,133

Rep: Reputation: 197Reputation: 197
What is your cron logging level? Have you tried adjusting it?

And the root session opened and then closed within a split second, if your machine is accessible using port 22 on the net, it's most likely those millions of cracked chinese computers that are used to try and attack other vulnerable machines with weak root and user passwords. Make sure root login via ssh is disabled and you shouldn't have any worries.
 
Old 10-22-2005, 08:06 AM   #3
a1tair
LQ Newbie
 
Registered: Oct 2005
Location: sg
Distribution: Ubuntu
Posts: 29

Original Poster
Rep: Reputation: 15
No i haven't tried changing anything of with the cron... thus i can't answer what level it is in, i don't know it too... pretty new to this. So you mean this is ok?? But it is pretty sequential. Every 5 min there is a mrgt thingy going on.. I dunno why it gave me a tick sound every 5 min dread... Anyway how do i go about disabling SSH for root. if i disable ssh for root, after i ssh in using a normal user i can still push it up to root lvl using su - right?

Thanks
 
Old 10-22-2005, 08:09 AM   #4
trickykid
Guru
 
Registered: Jan 2001
Posts: 24,133

Rep: Reputation: 197Reputation: 197
If you don't know what mtrg is, then turn it off in your crontab or check your /etc/cron.* directories for it.

http://people.ee.ethz.ch/~oetiker/webtools/mrtg/

It's a monitoring tool so it's probably setup to run every 5 minutes.
 
Old 10-22-2005, 10:52 AM   #5
a1tair
LQ Newbie
 
Registered: Oct 2005
Location: sg
Distribution: Ubuntu
Posts: 29

Original Poster
Rep: Reputation: 15
ok seems to be really this buggie causing all the trouble . but ermmm how do i disable it

inside cron.d/ i have got mrtg and sysstat

in mrtg i get this
*/5 * * * * root /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --confcache-file /var/lib/mrtg/mrtg.ok
while sysstat i get this 2 line
# run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib/sa/sa1 1 1
# generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib/sa/sa2 -A

issit ok if i just comment all these off?

ermmm wats with the accounting tool and daily summary...

Thanks
 
Old 10-22-2005, 11:06 AM   #6
trickykid
Guru
 
Registered: Jan 2001
Posts: 24,133

Rep: Reputation: 197Reputation: 197
Just comment out what you don't want to run..
 
Old 10-22-2005, 11:09 AM   #7
Berhanie
Senior Member
 
Registered: Dec 2003
Location: phnom penh
Distribution: Fedora
Posts: 1,625

Rep: Reputation: 165Reputation: 165
Quote:
every 5 min it is throwing this error.... Do you guys know how i can go about fixing it.
This is not an error. It's just crond logging its activities.
 
Old 10-22-2005, 11:59 AM   #8
a1tair
LQ Newbie
 
Registered: Oct 2005
Location: sg
Distribution: Ubuntu
Posts: 29

Original Poster
Rep: Reputation: 15
oh ya log i meant... anyway i mean every 5 min will only flood my log files.. behave like a small worm :X.
I manage to comment off and disable rootssh as recommended.

Thanks guys you guys rox!
 
Old 10-22-2005, 02:47 PM   #9
trickykid
Guru
 
Registered: Jan 2001
Posts: 24,133

Rep: Reputation: 197Reputation: 197
Oh and as for the loglevel, you can do this with the -l option..

You would change your startup scripts for cron to start with something like this:

/usr/sbin/crond -l8

Level 8 is default, add for more log output and details, minus for less crond logs..

man crond for more info..
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Constant Theme Error dj9928 Linux - Software 1 04-21-2005 02:33 AM
log level of crond Berhanie Slackware 2 01-04-2005 11:04 PM
c++ multi-character constant error? azucarmom Programming 4 12-05-2004 07:13 PM
kernel or crond error moonloader Linux - Software 2 02-05-2004 08:31 AM
parse error before constant dmaxj Programming 3 06-30-2003 03:07 PM


All times are GMT -5. The time now is 07:25 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration