Errors in Logwatch

[benito]

Hi !

Since several days i got this errors daily in my logwatch, what are this errors and how can i trace it ?

--------------------- Cron Begin ------------------------


**Unmatched Entries**
Sep 14 01:18:01 nikita crond[27063]: System error
Sep 14 01:18:01 nikita crond[27108]: System error
Sep 14 01:18:02 nikita crond[27110]: System error
Sep 14 02:33:02 nikita crond[11208]: System error
Sep 14 02:33:02 nikita crond[11207]: System error
Sep 14 02:41:02 nikita crond[19791]: System error
Sep 14 02:41:02 nikita crond[19792]: System error
Sep 14 02:41:02 nikita crond[19794]: System error
Sep 14 02:41:02 nikita crond[19811]: System error
Sep 14 02:41:02 nikita crond[19812]: System error
Sep 14 02:41:02 nikita crond[19815]: System error
Sep 14 02:41:02 nikita crond[19816]: System error
Sep 14 02:41:02 nikita crond[19820]: System error
Sep 14 02:41:02 nikita crond[19821]: System error
Sep 14 02:41:02 nikita crond[19822]: System error
Sep 14 02:41:02 nikita crond[19823]: System error
...

 

[benito]

Up to top.

 

[AndyReed]

Since several days i got this errors daily in my logwatch, what are this errors and how can i trace it ?

Is cron daemon up and running on your server? Did you check the cronjobs? Run this command at the prompt: crontab -l
to see if there a cronjob causing this error.

 

[benito]

Is cron daemon up and running on your server? Did you check the cronjobs? Run this command at the prompt: crontab -l
to see if there a cronjob causing this error.

Everything looks fine. In the file /var/logs/cron i got those errors between the regular ok logs.

Nov 8 06:24:01 nikita crond[7665]: (site1) CMD (/bin/nice /usr/bin/php -q /home/site1/public_html/st/admin/check.php $
Nov 8 06:24:01 nikita crond[7668]: (site1) CMD (/bin/nice /usr/bin/php -q /home/site1/public_html/st/admin/autocrop.p$
Nov 8 06:24:01 nikita crond[7671]: (site1) CMD (/usr/bin/php -q /home/site1/public_html/st/admin/cron.php server 1 > $
Nov 8 06:24:01 nikita crond[7606]: System error
Nov 8 06:24:01 nikita crond[7607]: System error
Nov 8 06:24:01 nikita crond[7630]: System error
Nov 8 06:24:01 nikita crond[7632]: System error
Nov 8 06:24:01 nikita crond[7644]: System error
Nov 8 06:24:01 nikita crond[7645]: System error
Nov 8 06:24:01 nikita crond[7646]: System error
Nov 8 06:24:01 nikita crond[7658]: System error
Nov 8 06:24:01 nikita crond[7659]: System error
Nov 8 06:24:01 nikita crond[7660]: System error
Nov 8 06:24:01 nikita crond[7676]: System error
Nov 8 06:24:01 nikita crond[7677]: System error
Nov 8 06:24:01 nikita crond[7678]: System error
Nov 8 06:24:01 nikita crond[7679]: System error
Nov 8 06:24:01 nikita crond[7691]: (site1) CMD (/bin/nice /usr/bin/php -q /home2/site1/public_html/st/admin/check.php >$
Nov 8 06:24:01 nikita crond[7692]: (site1) CMD (/home/site1/www/cgi-bin/at3/cronx.cgi)
Nov 8 06:24:01 nikita crond[7693]: (site1) CMD (/usr/bin/php -q /home/site1/public_html/st/admin/cron.php server 1 > $
N

 

[chirpy]

Check in all of your cron directories and cron spool files for dubious scripts or entries. That is:

ls -laR /etc/cron.*
cat /etc/crontab

Also look in all the files in /var/spool/cron/

If you find a core.* file in any of these you will need to scan for rootkits/root compromises.

 

[benito]

Check in all of your cron directories and cron spool files for dubious scripts or entries. That is:

ls -laR /etc/cron.*
cat /etc/crontab

Also look in all the files in /var/spool/cron/

If you find a core.* file in any of these you will need to scan for rootkits/root compromises.

Thanks, on /var/spool/cron are the sites crons and all looks ok.

I run "ls -laR /etc/cron.*" and get this, but i do not know if there are anything unusual there.

[email protected] [/var/spool/cron]# ls -laR /etc/cron.*
-rw-r--r--  1 root root    7 May 15 22:07 /etc/cron.deny

/etc/cron.d:
total 40
drwxr-xr-x   2 root root  4096 Aug  4 00:57 ./
drwxr-xr-x  95 root root 12288 Nov  9 16:23 ../
-rw-r--r--   1 root root    67 Nov  4  2005 atop
-rw-r--r--   1 root root    85 Aug  1 18:42 bfd
-rw-r--r--   1 root root   101 Aug  1 18:42 prm

/etc/cron.daily:
total 96
drwxr-xr-x   2 root root  4096 Aug 13 05:23 ./
drwxr-xr-x  95 root root 12288 Nov  9 16:23 ../
-rwxr-xr-x   1 root root   418 Apr 14  2006 00-makewhatis.cron*
-rwxr-xr-x   1 root root   276 Sep 28  2004 0anacron*
lrwxrwxrwx   1 root root    39 May 19 12:25 0logwatch -> /usr/share/logwatch/scripts/logwatch.pl*
-rw-r--r--   1 root root   797 Oct 19  2004 certwatch
-rwxr-xr-x   1 root root    57 May 16 02:16 fw*
-rwxr-xr-x   1 root root   208 May 20 10:52 logrotate*
-rwxr-xr-x   1 root root  2133 Dec  1  2004 prelink*
-rwxr-xr-x   1 root root   104 May 30 15:45 rpm*
-rwxr-xr-x   1 root root   121 Aug  8  2005 slocate.cron*
-rwxr-xr-x   1 root root   100 Jan  9  2006 tetex.cron*
-rwxr-xr-x   1 root root   286 Aug 13  2004 tmpwatch*

/etc/cron.hourly:
total 24
drwxr-xr-x   2 root root  4096 Sep 20  2004 ./
drwxr-xr-x  95 root root 12288 Nov  9 16:23 ../

/etc/cron.monthly:
total 32
drwxr-xr-x   2 root root  4096 Jan  9  2006 ./
drwxr-xr-x  95 root root 12288 Nov  9 16:23 ../
-rwxr-xr-x   1 root root   278 Sep 28  2004 0anacron*

/etc/cron.weekly:
total 36
drwxr-xr-x   2 root root  4096 Aug 13 05:20 ./
drwxr-xr-x  95 root root 12288 Nov  9 16:23 ../
-rwxr-xr-x   1 root root   414 Apr 14  2006 00-makewhatis.cron*
-rwxr-xr-x   1 root root   277 Sep 28  2004 0anacron*
[email protected] [/var/spool/cron]#

And the other command:

[email protected] [/var/spool/cron]# cat /etc/crontab
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly
15 5 * * * root up2date -u
[email protected] [/var/spool/cron]#