Hi guys,
I realize there have been constant disk activity even when i am not doing anything thus i decided to direct my /var/log/crond to tty8 and realize every 5 min it is throwing this error.... Do you guys know how i can go about fixing it.

Thanks in advance.

----------------------------------------
Sep 19 00:40:01 localhost crond[8282]: (root) CMD (/usr/lib/sa/sa1 1 1)
Sep 19 00:45:01 localhost crond[8341]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --confcache-file /var/lib/mrtg/mrtg.ok)
Sep 19 00:50:01 localhost crond[8391]: (root) CMD (/usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --confcache-file /var/lib/mrtg/mrtg.ok)

----------------------------------------
and of course i get a lot of these from /var/log/messages

Oct 3 05:00:01 localhost crond(pam_unix)[7864]: session opened for user root by (uid=0)
Oct 3 05:00:01 localhost crond(pam_unix)[7866]: session opened for user root by (uid=0)
Oct 3 05:00:02 localhost crond(pam_unix)[7866]: session closed for user root
Oct 3 05:00:02 localhost crond(pam_unix)[7864]: session closed for user root

What is your cron logging level? Have you tried adjusting it?

And the root session opened and then closed within a split second, if your machine is accessible using port 22 on the net, it's most likely those millions of cracked chinese computers that are used to try and attack other vulnerable machines with weak root and user passwords. Make sure root login via ssh is disabled and you shouldn't have any worries.

No i haven't tried changing anything of with the cron... thus i can't answer what level it is in, i don't know it too... pretty new to this. So you mean this is ok?? But it is pretty sequential. Every 5 min there is a mrgt thingy going on.. I dunno why it gave me a tick sound every 5 min dread... Anyway how do i go about disabling SSH for root. if i disable ssh for root, after i ssh in using a normal user i can still push it up to root lvl using su - right?

Thanks

If you don't know what mtrg is, then turn it off in your crontab or check your /etc/cron.* directories for it.

http://people.ee.ethz.ch/~oetiker/webtools/mrtg/

It's a monitoring tool so it's probably setup to run every 5 minutes.

ok seems to be really this buggie causing all the trouble . but ermmm how do i disable it

inside cron.d/ i have got mrtg and sysstat

in mrtg i get this
*/5 * * * * root /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --confcache-file /var/lib/mrtg/mrtg.ok
while sysstat i get this 2 line
# run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib/sa/sa1 1 1
# generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib/sa/sa2 -A

issit ok if i just comment all these off?

ermmm wats with the accounting tool and daily summary...

Thanks

Just comment out what you don't want to run..

This is not an error. It's just crond logging its activities.

oh ya log i meant... anyway i mean every 5 min will only flood my log files.. behave like a small worm :X.
I manage to comment off and disable rootssh as recommended.

Thanks guys you guys rox!

Oh and as for the loglevel, you can do this with the -l option..

You would change your startup scripts for cron to start with something like this:

/usr/sbin/crond -l8

Level 8 is default, add for more log output and details, minus for less crond logs..

man crond for more info..