Mar 052015
 

Hi,

Everyday, logwatch send out an email report with information about the server. Today I seen:

Cron Begin
  ORPHAN entries: 2
Cron End

In researching this, I found and fixed the following:

[[email protected]] >> grep "ORPHAN" /var/log/cron
Mar  3 09:17:26 host crond[6542]: (root-bak) ORPHAN (no passwd entry)
Mar  3 09:17:27 host crond[6542]: (munin) ORPHAN (no passwd entry)
Mar  4 08:34:01 host crond[6542]: (root-bak) ORPHAN (no passwd entry)
Mar  4 08:34:01 host crond[6542]: (munin) ORPHAN (no passwd entry)

(I recently disabled munin so I know where that one came from, not sure about root-bak but will check on that later, anyways…)

I did a quick search of /var/spool/cron/ and seen the two cron users there

[[email protected]] >> ll /var/spool/cron/
total 56
drwx------  2 root            root 4096 Feb 27 00:26 ./
drwxr-xr-x 16 root            root 4096 Feb 26 08:52 ../
-rw-------  1 root            root   18 May 28  2014 aatr
-rw-------  1 user1           root   48 Jan 19 09:46 user1
-rw-------  1 user2           root  158 Feb 10 09:36 user2
-rw-------  1 user3           root  160 Dec 24 11:32 user3
-rw-------  1 root            root   18 May 28  2014 user4
-rw-------  1 root            root   18 May 28  2014 user5
-rw-------  1 root            root   18 May 28  2014 user6
-rw-------  1 root            root 1688 Feb 27 00:26 mailman
-rw-------  1 root            root    0 May  8  2013 munin
-rw-------  1 user7           root  282 Dec 15 08:37 user7
-rw-------  1 user8           root  282 Jan 23 13:43 user8
-rw-------  1 root            root 1343 Feb 26 00:22 root
-rw-r--r--  1 root            root 1343 Aug  6  2014 root-bak

I then removed those users from the cron

[[email protected]] >> rm /var/spool/cron/root-bak
/bin/rm: remove regular file `/var/spool/cron/root-bak'? y
[[email protected]] >> rm /var/spool/cron/munin
/bin/rm: remove regular empty file `/var/spool/cron/munin'? y

We’ll see if this error shows up in tomorrows report…

Share This!
 Posted by at 9:02 am