[plug] re: log message

[Matt Kemner]

On Sun, 2 Jul 2000, MMT wrote:

> Can anyone tell me why there are so many open and close session going on
> here, this is a small sample:
> Jul  2 17:05:00 gateway PAM_pwdb[25535]: (su) session closed for user tour
> Jul  2 17:10:00 gateway PAM_pwdb[25553]: (su) session opened for user tour
> by (uid=0)
> Jul  2 17:10:00 gateway PAM_pwdb[25553]: (su) session closed for user tour
> Jul  2 17:15:00 gateway PAM_pwdb[25571]: (su) session opened for user tour
> by (uid=0)
> Jul  2 17:15:00 gateway PAM_pwdb[25571]: (su) session closed for user tour

Looks like a cron script is running as root every 5 minutes, which then
runs a command as the user "tour".

Look for an entry in /etc/crontab that looks something like:

*/5 *   * * *   root	su - tour -c <command>

It might also run a shell script that does the su, so you may have to
check each entry to see what it actually does.

It also might be present in root's crontab (as opposed to the global
/etc/crontab)

type "crontab -l" to view it or "crontab -e" to edit it.

 - Matt