**Unmatched Entries**
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
---------------------- Cron End -------------------------
/var/log/cron:
Dec 9 10:58:00 webserver crond[1120]: (tmp.1136) ORPHAN (no passwd entry)
Dec 9 10:58:00 webserver crond[1120]: (root) RELOAD (cron/root)
Dec 9 10:58:00 webserver crond[1120]: (tmp.8970) ORPHAN (no passwd entry)
Dec 9 10:58:00 webserver crond[1120]: (tmp.12560) ORPHAN (no passwd entry)
Dec 9 10:58:00 webserver crond[1120]: (tmp.3833) ORPHAN (no passwd entry)
[root@webserver ]# ll /var/spool/cron/
total 12
drwx------ 2 root root 4096 Dec 9 10:57 .
drwxr-xr-x 12 root root 4096 Jun 28 2004 ..
-rw------- 1 root root 679 Dec 9 10:57 root
-rw-r--r-- 1 root root 0 Nov 22 2006 tmp.1136
-rw-r--r-- 1 root root 0 Oct 16 2007 tmp.12560
-rw-r--r-- 1 root root 0 Apr 14 2008 tmp.3833
-rw-r--r-- 1 root root 0 Jan 26 2007 tmp.8970
Solution:
on redhat boxes crons could run from a few spots:
/var/spool/cron
/etc/crontab
/etc/cron.hourly
/etc/cron.daily
/etc/cron.weekly
/etc/cron.monthly
Found them here:
/var/spool/cron/
I've removed and will see the result in the AM.
Thx much.
JB
Reply With Quote
JayBaen
View Public Profile
Find all posts by JayBaen
#6
Old 03-06-2005, 06:42 PM
JayBaen JayBaen is offline
Registered User
Join Date: Apr 2004
Posts: 186
Alrighty ... that worked to solve that part of the equasion, however, I'm now getting a few more of these than I'd like daily:
Code:
ORPHAN (no passwd entry)
In the logwatch.
I've read that this is usually due to something trying to run a cron job against a non-existent user account. I've checked what I can and don't see any rogue cron jobs left. Any thoughts on where to hunt?
Reference: http://www.interworx.com/forums/showthread.php?t=437
