Linux Log中大量 crond(pam_unix)[10094]: session opened for user root by (uid=0)

最新推荐文章于 2024-09-04 10:34:07 发布

转载最新推荐文章于 2024-09-04 10:34:07 发布 · 1.9k 阅读

本文记录了Red Hat Enterprise Linux AS 4系统中/var/log/message及/var/log/cron的日志异常情况，包括用户会话的频繁开启与关闭以及定时任务的执行记录，并提供了调整syslog配置文件来过滤特定日志的解决方案。

Red Hat Enterprise Linux AS release 4 (Nahant)
Kernel 2.6.9-5.ELsmp on an i686

问题未解决 -

/var/log/message 文件：

Sep 13 04:40:01 Brazil_DMDI sshd(pam_unix)[9495]: session closed for user oracle
Sep 13 04:40:38 Brazil_DMDI sshd(pam_unix)[9687]: session opened for user root by root(uid=0)
Sep 13 04:41:01 Brazil_DMDI crond(pam_unix)[9805]: session opened for user root by (uid=0)
Sep 13 04:41:01 Brazil_DMDI crond(pam_unix)[9805]: session closed for user root
Sep 13 04:42:01 Brazil_DMDI crond(pam_unix)[10094]: session opened for user root by (uid=0)
Sep 13 04:42:01 Brazil_DMDI crond(pam_unix)[10094]: session closed for user root
Sep 13 04:43:01 Brazil_DMDI crond(pam_unix)[10322]: session opened for user root by (uid=0)
Sep 13 04:43:01 Brazil_DMDI crond(pam_unix)[10322]: session closed for user root
Sep 13 04:44:01 Brazil_DMDI crond(pam_unix)[10594]: session opened for user root by (uid=0)
Sep 13 04:44:01 Brazil_DMDI crond(pam_unix)[10594]: session closed for user root
Sep 13 04:45:01 Brazil_DMDI crond(pam_unix)[10845]: session opened for user root by (uid=0)

/var/log/cron 文件：

Sep 13 04:34:01 Brazil_DMDI crond[7564]: (root) CMD (sh /data/run/loadavg 1>/data/run/log/loadavg.log

2>>/data/run/log/loadavg.bad)
Sep 13 04:35:02 Brazil_DMDI crond[7855]: (root) CMD (sh /data/run/loadavg 1>/data/run/log/loadavg.log

2>>/data/run/log/loadavg.bad)
Sep 13 04:36:01 Brazil_DMDI crond[8220]: (root) CMD (sh /data/run/loadavg 1>/data/run/log/loadavg.log

2>>/data/run/log/loadavg.bad)
Sep 13 04:37:01 Brazil_DMDI crond[8557]: (root) CMD (sh /data/run/loadavg 1>/data/run/log/loadavg.log

2>>/data/run/log/loadavg.bad)
Sep 13 04:38:01 Brazil_DMDI crond[8865]: (root) CMD (sh /data/run/loadavg 1>/data/run/log/loadavg.log

2>>/data/run/log/loadavg.bad)
Sep 13 04:39:01 Brazil_DMDI crond[9152]: (root) CMD (sh /data/run/loadavg 1>/data/run/log/loadavg.log

2>>/data/run/log/loadavg.bad)
Sep 13 04:40:01 Brazil_DMDI crond[9489]: (root) CMD (sh /data/run/loadavg 1>/data/run/log/loadavg.log

修改/etc/syslog.conf 中的message输出部分，在其中加入cron.none;auth.none .

[root@Brazil_DMDI etc]# vi syslog.conf
*.info;mail.none;authpriv.none;cron.none;auth.none /var/log/messages

重新启动服务。
[root@Brazil_DMDI etc]# /etc/init.d/crond restart
Stopping crond: [ OK ]
Starting crond: [ OK ]
[root@Brazil_DMDI etc]#

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/35489/viewspace-673759/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/35489/viewspace-673759/