In my SSH log
- /var/log/auth.log
I have the following 2 rows (which are repeated every hour):
...
Jan 22 03:28:01 mam CRON[15934]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 22 03:28:01 mam CRON[15934]: pam_unix(cron:session): session closed for user root
Jan 22 04:28:01 mam CRON[15943]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 22 04:28:01 mam CRON[15943]: pam_unix(cron:session): session closed for user root
...
This looks like a CRON job but when I check them for user root I get this:
- root@mam:~# crontab -l
no crontab for root
Any suggestions regarding the cause and how to fix it?
Thanks, Udo
Update (based on the input from grawity):
I checked
# m h dom mon dow user command
28 * * * * root cd / && run-parts --report /etc/cron.hourly
56 23 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
8 23 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
13 23 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
Looks that command
- cd / && run-parts --report /etc/cron.hourly
is run hourly (at minute 28...) and executes what is in directory
- /etc/cron.hourly/
But this directory is empty:
root@mam:/# ls -al /etc/cron.hourly/
total 12
drwxr-xr-x 2 root root 4096 2010-10-12 16:26 .
drwxr-xr-x 67 root root 4096 2011-01-22 16:15 ..
-rw-r--r-- 1 root root 102 2010-08-24 20:45 .placeholder