Hi,
Everyday, logwatch send out an email report with information about the server. Today I seen:
Cron Begin ORPHAN entries: 2 Cron End
In researching this, I found and fixed the following:
[root@host.domain.com] >> grep "ORPHAN" /var/log/cron
Mar 3 09:17:26 host crond[6542]: (root-bak) ORPHAN (no passwd entry)
Mar 3 09:17:27 host crond[6542]: (munin) ORPHAN (no passwd entry)
Mar 4 08:34:01 host crond[6542]: (root-bak) ORPHAN (no passwd entry)
Mar 4 08:34:01 host crond[6542]: (munin) ORPHAN (no passwd entry)
(I recently disabled munin so I know where that one came from, not sure about root-bak but will check on that later, anyways…)
I did a quick search of /var/spool/cron/ and seen the two cron users there
[root@host.domain.com] >> ll /var/spool/cron/
total 56
drwx------ 2 root root 4096 Feb 27 00:26 ./
drwxr-xr-x 16 root root 4096 Feb 26 08:52 ../
-rw------- 1 root root 18 May 28 2014 aatr
-rw------- 1 user1 root 48 Jan 19 09:46 user1
-rw------- 1 user2 root 158 Feb 10 09:36 user2
-rw------- 1 user3 root 160 Dec 24 11:32 user3
-rw------- 1 root root 18 May 28 2014 user4
-rw------- 1 root root 18 May 28 2014 user5
-rw------- 1 root root 18 May 28 2014 user6
-rw------- 1 root root 1688 Feb 27 00:26 mailman
-rw------- 1 root root 0 May 8 2013 munin
-rw------- 1 user7 root 282 Dec 15 08:37 user7
-rw------- 1 user8 root 282 Jan 23 13:43 user8
-rw------- 1 root root 1343 Feb 26 00:22 root
-rw-r--r-- 1 root root 1343 Aug 6 2014 root-bak
I then removed those users from the cron
[root@host.domain.com] >> rm /var/spool/cron/root-bak
/bin/rm: remove regular file `/var/spool/cron/root-bak'? y
[root@host.domain.com] >> rm /var/spool/cron/munin
/bin/rm: remove regular empty file `/var/spool/cron/munin'? y
We’ll see if this error shows up in tomorrows report…
