Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In my SSH log

  • /var/log/auth.log

I have the following 2 rows (which are repeated every hour):

...
Jan 22 03:28:01 mam CRON[15934]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 22 03:28:01 mam CRON[15934]: pam_unix(cron:session): session closed for user root

Jan 22 04:28:01 mam CRON[15943]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 22 04:28:01 mam CRON[15943]: pam_unix(cron:session): session closed for user root
...

This looks like a CRON job but when I check them for user root I get this:

  • root@mam:~# crontab -l
    no crontab for root

Any suggestions regarding the cause and how to fix it?

Thanks, Udo

Update (based on the input from grawity):

I checked

# m h dom mon dow user  command
28 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
56 23    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
8 23    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
13 23    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

Looks that command

  • cd / && run-parts --report /etc/cron.hourly

is run hourly (at minute 28...) and executes what is in directory

  • /etc/cron.hourly/

But this directory is empty:

root@mam:/# ls -al /etc/cron.hourly/
total 12
drwxr-xr-x 2 root root 4096 2010-10-12 16:26 .
drwxr-xr-x 67 root root 4096 2011-01-22 16:15 ..
-rw-r--r-- 1 root root 102 2010-08-24 20:45 .placeholder

share|improve this question
    
It doesn't matter if the /etc/cron.hourly directory is empty. Cron still execute (and use PAM) this job "cd / && run-parts...". –  kupson Mar 18 '12 at 3:19
    
Please don't cross post questions to multiple Stackexchange sites. –  Iain Jun 30 '12 at 6:55
    
somebody migrated the question which then was immediately closed as duplicate of this original question... –  udo Jul 2 '12 at 7:18

2 Answers 2

up vote 4 down vote accepted

Ubuntu uses vixie-cron, which, in addition to /var/spool/cron, also looks in /etc/crontab and /etc/cron.d/*.


<Edit> According to your update, you have four cronjobs in /etc/crontab. They are being run by cron on their specified times, and that's what causes the syslog messages.

cron itself does not know anything about /etc/cron.hourly/, it just runs run-parts, which handles said directory. As far as cron is concerned, the cd / && run-parts --report /etc/cron.hourly job is exactly like another job, scheduled to run hourly. It is not magically skipped.

share|improve this answer

Look /etc/cron.d or use find:

#find /etc/ -type f -exec grep -E "^28[ \t]" {} \; -print
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.