The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Errors in Logwatch

Discussion in 'General Discussion' started by benito, Sep 15, 2006.

  1. benito

    benito Well-Known Member

    Joined:
    Jan 8, 2004
    Messages:
    296
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    Mar del Plata - Argentina
    Hi !

    Since several days i got this errors daily in my logwatch, what are this errors and how can i trace it ?

     
  2. benito

    benito Well-Known Member

    Joined:
    Jan 8, 2004
    Messages:
    296
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    Mar del Plata - Argentina
    Up to top.
     
  3. AndyReed

    AndyReed Well-Known Member
    PartnerNOC

    Joined:
    May 29, 2004
    Messages:
    2,222
    Likes Received:
    3
    Trophy Points:
    38
    Location:
    Minneapolis, MN
    Is cron daemon up and running on your server? Did you check the cronjobs? Run this command at the prompt: crontab -l
    to see if there a cronjob causing this error.
     
  4. benito

    benito Well-Known Member

    Joined:
    Jan 8, 2004
    Messages:
    296
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    Mar del Plata - Argentina

    Everything looks fine. In the file /var/logs/cron i got those errors between the regular ok logs.

    Nov 8 06:24:01 nikita crond[7665]: (site1) CMD (/bin/nice /usr/bin/php -q /home/site1/public_html/st/admin/check.php $
    Nov 8 06:24:01 nikita crond[7668]: (site1) CMD (/bin/nice /usr/bin/php -q /home/site1/public_html/st/admin/autocrop.p$
    Nov 8 06:24:01 nikita crond[7671]: (site1) CMD (/usr/bin/php -q /home/site1/public_html/st/admin/cron.php server 1 > $
    Nov 8 06:24:01 nikita crond[7606]: System error
    Nov 8 06:24:01 nikita crond[7607]: System error
    Nov 8 06:24:01 nikita crond[7630]: System error
    Nov 8 06:24:01 nikita crond[7632]: System error
    Nov 8 06:24:01 nikita crond[7644]: System error
    Nov 8 06:24:01 nikita crond[7645]: System error
    Nov 8 06:24:01 nikita crond[7646]: System error
    Nov 8 06:24:01 nikita crond[7658]: System error
    Nov 8 06:24:01 nikita crond[7659]: System error
    Nov 8 06:24:01 nikita crond[7660]: System error
    Nov 8 06:24:01 nikita crond[7676]: System error
    Nov 8 06:24:01 nikita crond[7677]: System error
    Nov 8 06:24:01 nikita crond[7678]: System error
    Nov 8 06:24:01 nikita crond[7679]: System error
    Nov 8 06:24:01 nikita crond[7691]: (site1) CMD (/bin/nice /usr/bin/php -q /home2/site1/public_html/st/admin/check.php >$
    Nov 8 06:24:01 nikita crond[7692]: (site1) CMD (/home/site1/www/cgi-bin/at3/cronx.cgi)
    Nov 8 06:24:01 nikita crond[7693]: (site1) CMD (/usr/bin/php -q /home/site1/public_html/st/admin/cron.php server 1 > $
    N
     
  5. chirpy

    chirpy Well-Known Member

    Joined:
    Jun 15, 2002
    Messages:
    13,475
    Likes Received:
    20
    Trophy Points:
    38
    Location:
    Go on, have a guess
    Check in all of your cron directories and cron spool files for dubious scripts or entries. That is:

    ls -laR /etc/cron.*
    cat /etc/crontab

    Also look in all the files in /var/spool/cron/

    If you find a core.* file in any of these you will need to scan for rootkits/root compromises.
     
  6. benito

    benito Well-Known Member

    Joined:
    Jan 8, 2004
    Messages:
    296
    Likes Received:
    1
    Trophy Points:
    18
    Location:
    Mar del Plata - Argentina
    Thanks, on /var/spool/cron are the sites crons and all looks ok.

    I run "ls -laR /etc/cron.*" and get this, but i do not know if there are anything unusual there.

    Code:
    root@nikita [/var/spool/cron]# ls -laR /etc/cron.*
    -rw-r--r--  1 root root    7 May 15 22:07 /etc/cron.deny
    
    /etc/cron.d:
    total 40
    drwxr-xr-x   2 root root  4096 Aug  4 00:57 ./
    drwxr-xr-x  95 root root 12288 Nov  9 16:23 ../
    -rw-r--r--   1 root root    67 Nov  4  2005 atop
    -rw-r--r--   1 root root    85 Aug  1 18:42 bfd
    -rw-r--r--   1 root root   101 Aug  1 18:42 prm
    
    /etc/cron.daily:
    total 96
    drwxr-xr-x   2 root root  4096 Aug 13 05:23 ./
    drwxr-xr-x  95 root root 12288 Nov  9 16:23 ../
    -rwxr-xr-x   1 root root   418 Apr 14  2006 00-makewhatis.cron*
    -rwxr-xr-x   1 root root   276 Sep 28  2004 0anacron*
    lrwxrwxrwx   1 root root    39 May 19 12:25 0logwatch -> /usr/share/logwatch/scripts/logwatch.pl*
    -rw-r--r--   1 root root   797 Oct 19  2004 certwatch
    -rwxr-xr-x   1 root root    57 May 16 02:16 fw*
    -rwxr-xr-x   1 root root   208 May 20 10:52 logrotate*
    -rwxr-xr-x   1 root root  2133 Dec  1  2004 prelink*
    -rwxr-xr-x   1 root root   104 May 30 15:45 rpm*
    -rwxr-xr-x   1 root root   121 Aug  8  2005 slocate.cron*
    -rwxr-xr-x   1 root root   100 Jan  9  2006 tetex.cron*
    -rwxr-xr-x   1 root root   286 Aug 13  2004 tmpwatch*
    
    /etc/cron.hourly:
    total 24
    drwxr-xr-x   2 root root  4096 Sep 20  2004 ./
    drwxr-xr-x  95 root root 12288 Nov  9 16:23 ../
    
    /etc/cron.monthly:
    total 32
    drwxr-xr-x   2 root root  4096 Jan  9  2006 ./
    drwxr-xr-x  95 root root 12288 Nov  9 16:23 ../
    -rwxr-xr-x   1 root root   278 Sep 28  2004 0anacron*
    
    /etc/cron.weekly:
    total 36
    drwxr-xr-x   2 root root  4096 Aug 13 05:20 ./
    drwxr-xr-x  95 root root 12288 Nov  9 16:23 ../
    -rwxr-xr-x   1 root root   414 Apr 14  2006 00-makewhatis.cron*
    -rwxr-xr-x   1 root root   277 Sep 28  2004 0anacron*
    root@nikita [/var/spool/cron]#
    And the other command:

    Code:
    root@nikita [/var/spool/cron]# cat /etc/crontab
    SHELL=/bin/bash
    PATH=/sbin:/bin:/usr/sbin:/usr/bin
    MAILTO=root
    HOME=/
    
    # run-parts
    01 * * * * root run-parts /etc/cron.hourly
    02 4 * * * root run-parts /etc/cron.daily
    22 4 * * 0 root run-parts /etc/cron.weekly
    42 4 1 * * root run-parts /etc/cron.monthly
    15 5 * * * root up2date -u
    root@nikita [/var/spool/cron]#
     
Loading...

Share This Page