Hi, <\/p>\n
Everyday, logwatch send out an email report with information about the server. Today I seen:<\/p>\n
Cron Begin\n ORPHAN entries: 2\nCron End<\/pre>\nIn researching this, I found and fixed the following:
\n
\n[root@host.domain.com] >> grep \"ORPHAN\" \/var\/log\/cron
\nMar 3 09:17:26 host crond[6542]: (root-bak) ORPHAN (no passwd entry)
\nMar 3 09:17:27 host crond[6542]: (munin) ORPHAN (no passwd entry)
\nMar 4 08:34:01 host crond[6542]: (root-bak) ORPHAN (no passwd entry)
\nMar 4 08:34:01 host crond[6542]: (munin) ORPHAN (no passwd entry)<\/code><\/p>\n(I recently disabled munin so I know where that one came from, not sure about root-bak but will check on that later, anyways…<\/em>)<\/p>\n
I did a quick search of \/var\/spool\/cron\/ and seen the two cron users there<\/p>\n
[root@host.domain.com] >> ll \/var\/spool\/cron\/
\ntotal 56
\ndrwx------ 2 root root 4096 Feb 27 00:26 .\/
\ndrwxr-xr-x 16 root root 4096 Feb 26 08:52 ..\/
\n-rw------- 1 root root 18 May 28 2014 aatr
\n-rw------- 1 user1 root 48 Jan 19 09:46 user1
\n-rw------- 1 user2 root 158 Feb 10 09:36 user2
\n-rw------- 1 user3 root 160 Dec 24 11:32 user3
\n-rw------- 1 root root 18 May 28 2014 user4
\n-rw------- 1 root root 18 May 28 2014 user5
\n-rw------- 1 root root 18 May 28 2014 user6
\n-rw------- 1 root root 1688 Feb 27 00:26 mailman
\n-rw------- 1 root root 0 May 8 2013 munin
\n-rw------- 1 user7 root 282 Dec 15 08:37 user7
\n-rw------- 1 user8 root 282 Jan 23 13:43 user8
\n-rw------- 1 root root 1343 Feb 26 00:22 root
\n-rw-r--r-- 1 root root 1343 Aug 6 2014 root-bak<\/code><\/p>\nI then removed those users from the cron<\/p>\n
[root@host.domain.com] >> rm \/var\/spool\/cron\/root-bak
\n\/bin\/rm: remove regular file `\/var\/spool\/cron\/root-bak'? y
\n[root@host.domain.com] >> rm \/var\/spool\/cron\/munin
\n\/bin\/rm: remove regular empty file `\/var\/spool\/cron\/munin'? y<\/code><\/p>\nWe’ll see if this error shows up in tomorrows report…<\/p>\n","protected":false},"excerpt":{"rendered":"
Hi, Everyday, logwatch send out an email report with information about the server. Today I seen: Cron Begin ORPHAN entries: 2 Cron End In researching this, I found and fixed the following:… <\/p>\n