audit.log中的cron是什么意思?

yoursmile

/var/log/audit/audit.log中的内容(时间我已经转换成可读模式)

1. type=USER_ACCT msg=audit(Sun Jul 13 04:22:01 2008.808:16623): user pid=28310 uid=0 auid=4294967295 msg='PAM: accounting acct=
   
2. root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
   
3. type=CRED_ACQ msg=audit(Sun Jul 13 04:22:01 2008.808:16624): user pid=28310 uid=0 auid=4294967295 msg='PAM: setcred acct=root
   
4. : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
   
5. type=LOGIN msg=audit(Sun Jul 13 04:22:01 2008.808:16625): login pid=28310 uid=0 old auid=4294967295 new auid=0
   
6. type=USER_START msg=audit(Sun Jul 13 04:22:01 2008.824:16626): user pid=28310 uid=0 auid=0 msg='PAM: session open acct=root :
   
7. exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
   
8. type=CRED_DISP msg=audit(Sun Jul 13 04:27:49 2008.974:16627): user pid=28310 uid=0 auid=0 msg='PAM: setcred acct=root : exe="
   
9. /usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
   
10. type=USER_END msg=audit(Sun Jul 13 04:27:49 2008.974:16628): user pid=28310 uid=0 auid=0 msg='PAM: session close acct=root :
    
11. exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
    
12. type=USER_ACCT msg=audit(Sun Jul 13 05:01:01 2008.283:16629): user pid=16240 uid=0 auid=4294967295 msg='PAM: accounting acct=
    
13. root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
    
14. type=CRED_ACQ msg=audit(Sun Jul 13 05:01:01 2008.283:16630): user pid=16240 uid=0 auid=4294967295 msg='PAM: setcred acct=root
    
15. : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
    
16. type=LOGIN msg=audit(Sun Jul 13 05:01:01 2008.283:16631): login pid=16240 uid=0 old auid=4294967295 new auid=0
    
17. type=USER_START msg=audit(Sun Jul 13 05:01:01 2008.331:16632): user pid=16240 uid=0 auid=0 msg='PAM: session open acct=root :
    
18. exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
    
19. type=CRED_DISP msg=audit(Sun Jul 13 05:01:01 2008.663:16633): user pid=16240 uid=0 auid=0 msg='PAM: setcred acct=root : exe="
    
20. /usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
    
21. type=USER_END msg=audit(Sun Jul 13 05:01:01 2008.663:16634): user pid=16240 uid=0 auid=0 msg='PAM: session close acct=root :
    
22. exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'

复制代码

问题:
1.exe="/usr/sbin/crond" 为什么会执行这个程序?

2.terminal=cron 是什么终端??

3.hostname=?addr=? 为什么没有记录?

4.时间是凌晨,可以肯定无人登陆电脑,为什么会出现这些日志?

yoursmile

我的问题不能就这样沉了啊

richardzhang

cron是linux的一个内置服务，开启并编辑后可以每隔一段时间系统自动执行你设定的命令
你的电脑晚上是系统按照cron的设置自己定期运行的

详细你可以上网搜下，很多的

cuci

crontab去了解下

vermouth

只要机子打开，里面有服务运行，就会出现各种相应的日志啊~
lz可以看下，你这是什么日志，然后逐步分析。

yoursmile

偶怕被中rootkit啊........

todayboy

看看http://www.stl.gtri.gatech.edu/jroys/ 这里吧，就明白了！

todayboy

我的也是这个情况，机子老死！！！！！（一小段）

name=?, addr=?, terminal=cron res=success)'
Aug 17 19:50:01 bztdxxl kernel: audit(1250509801.078:5066): login pid=4832 uid=0 old auid=0 new auid=0
Aug 17 19:50:01 bztdxxl kernel: audit(1250509801.079:5067): user pid=4832 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
Aug 17 19:50:01 bztdxxl kernel: audit(1250509801.125:506: user pid=4832 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
Aug 17 19:50:01 bztdxxl kernel: audit(1250509801.125:5069): user pid=4832 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
Aug 17 20:00:01 bztdxxl kernel: audit(1250510401.154:5070): user pid=9273 uid=0 auid=0 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
Aug 17 20:00:01 bztdxxl kernel: audit(1250510401.154:5071): user pid=9273 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
Aug 17 20:00:01 bztdxxl kernel: audit(1250510401.154:5072): login pid=9273 uid=0 old auid=0 new auid=0
Aug 17 20:00:01 bztdxxl kernel: audit(1250510401.154:5073): user pid=9273 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
Aug 17 20:00:01 bztdxxl kernel: audit(1250510401.182:5074): user pid=9273 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
Aug 17 20:00:01 bztdxxl kernel: audit(1250510401.182:5075): user pid=9273 uid=0 auid=0 msg='PAM: session close acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
Aug 17 20:01:01 bztdxxl kernel: audit(1250510461.187:5076): user pid=9767 uid=0 auid=0 msg='PAM: accounting acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
Aug 17 20:01:01 bztdxxl kernel: audit(1250510461.187:5077): user pid=9767 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
Aug 17 20:01:01 bztdxxl kernel: audit(1250510461.188:507: login pid=9767 uid=0 old auid=0 new auid=0
Aug 17 20:01:01 bztdxxl kernel: audit(1250510461.188:5079): user pid=9767 uid=0 auid=0 msg='PAM: session open acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
Aug 17 20:01:01 bztdxxl kernel: audit(1250510461.194:5080): user pid=9767 uid=0 auid=0 msg='PAM: setcred acct=root : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'