pam_unix(cron:session): session opened for user root by (uid=0)

Question

In my SSH log

• /var/log/auth.log

I have the following 2 rows (which are repeated every hour):

...
Jan 22 03:28:01 mam CRON[15934]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 22 03:28:01 mam CRON[15934]: pam_unix(cron:session): session closed for user root
Jan 22 04:28:01 mam CRON[15943]: pam_unix(cron:session): session opened for user root by (uid=0)
Jan 22 04:28:01 mam CRON[15943]: pam_unix(cron:session): session closed for user root
...

This looks like a CRON job but when I check them for user root I get this:

• root@mam:~# crontab -l
  no crontab for root

Any suggestions regarding the cause and how to fix it?

Thanks, Udo

Update (based on the input from grawity):

I checked

# m h dom mon dow user  command
28 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
56 23    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
8 23    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
13 23    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

Looks that command

• cd / && run-parts --report /etc/cron.hourly

is run hourly (at minute 28...) and executes what is in directory

• /etc/cron.hourly/

But this directory is empty:

root@mam:/# ls -al /etc/cron.hourly/
total 12
drwxr-xr-x 2 root root 4096 2010-10-12 16:26 .
drwxr-xr-x 67 root root 4096 2011-01-22 16:15 ..
-rw-r--r-- 1 root root 102 2010-08-24 20:45 .placeholder

Answer 1

Ubuntu uses vixie-cron, which, in addition to /var/spool/cron, also looks in /etc/crontab and /etc/cron.d/*.

---

<Edit> According to your update, you have four cronjobs in /etc/crontab. They are being run by cron on their specified times, and that's what causes the syslog messages.

cron itself does not know anything about /etc/cron.hourly/, it just runs run-parts, which handles said directory. As far as cron is concerned, the cd / && run-parts --report /etc/cron.hourly job is exactly like another job, scheduled to run hourly. It is not magically skipped.

Answer 2

Look /etc/cron.d or use find:

#find /etc/ -type f -exec grep -E "^28[ \t]" {} \; -print