Thursday, December 10, 2009

Logwatch cron ORPHAN (no passwd entry)

SkyHi @ Thursday, December 10, 2009
Error in Logwatch:

**Unmatched Entries**
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)

---------------------- Cron End -------------------------


/var/log/cron:

Dec 9 10:58:00 webserver crond[1120]: (tmp.1136) ORPHAN (no passwd entry)
Dec 9 10:58:00 webserver crond[1120]: (root) RELOAD (cron/root)
Dec 9 10:58:00 webserver crond[1120]: (tmp.8970) ORPHAN (no passwd entry)
Dec 9 10:58:00 webserver crond[1120]: (tmp.12560) ORPHAN (no passwd entry)
Dec 9 10:58:00 webserver crond[1120]: (tmp.3833) ORPHAN (no passwd entry)


[root@webserver ]# ll /var/spool/cron/
total 12
drwx------ 2 root root 4096 Dec 9 10:57 .
drwxr-xr-x 12 root root 4096 Jun 28 2004 ..
-rw------- 1 root root 679 Dec 9 10:57 root
-rw-r--r-- 1 root root 0 Nov 22 2006 tmp.1136
-rw-r--r-- 1 root root 0 Oct 16 2007 tmp.12560
-rw-r--r-- 1 root root 0 Apr 14 2008 tmp.3833
-rw-r--r-- 1 root root 0 Jan 26 2007 tmp.8970


Solution:

on redhat boxes crons could run from a few spots:

/var/spool/cron
/etc/crontab
/etc/cron.hourly
/etc/cron.daily
/etc/cron.weekly
/etc/cron.monthly


Found them here:

/var/spool/cron/

I've removed and will see the result in the AM.

Thx much.

JB
Reply With Quote
JayBaen
View Public Profile
Find all posts by JayBaen
#6
Old 03-06-2005, 06:42 PM
JayBaen JayBaen is offline
Registered User

Join Date: Apr 2004
Posts: 186
Alrighty ... that worked to solve that part of the equasion, however, I'm now getting a few more of these than I'd like daily:

Code:

ORPHAN (no passwd entry)

In the logwatch.

I've read that this is usually due to something trying to run a cron job against a non-existent user account. I've checked what I can and don't see any rogue cron jobs left. Any thoughts on where to hunt?

Reference: http://www.interworx.com/forums/showthread.php?t=437