Audit and Messages Question

[lamans]

Hiya..

I cant find anything relating to this after a good few searches... In my messages and audit logs i keep getting this message like every few seconds... I get like 5000 or 6000 of these a day... Over and over the only thing that changes is the user pid and the audit number...

audit(1143932402.162:27698): user pid=4392 uid=0 auid=4294967295 msg='PAM accounting: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron result=Success)'

audit(1143932402.340:27699): user pid=4387 uid=0 auid=4294967295 msg='PAM accounting: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron result=Success)'

audit(1143932402.368:27700): user pid=4387 uid=0 auid=4294967295 msg='PAM session open: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron result=Success)'

audit(1143932402.372:27701): user pid=4387 uid=0 auid=4294967295 msg='PAM setcred: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron result=Success)'

Can anyone shine any light on this for me...

With Thanks Yo

 

[chirpy]

It's a "feature" introduced into FC3/FC4. You can stop them from being logged by editing /etc/syslog.conf and look for the line:

*.info;mail.none;news.none;authpriv.none;cron.none             /var/log/messages

Change it to:

*.info;mail.none;news.none;authpriv.none;cron.none;auth.!=info  /var/log/messages

Then restart syslog:

service syslog restart

 

[lamans]

Hiya...

Thanks man your on the ball...