Syslog estranho para meu servidor

Question

Hoje eu vou no meu log com nano /var/log/syslog

Eu tenho isso e acho que não é muito bom:

Aug 27 06:25:02 ks3309528 rsyslogd: [origin software="rsyslogd" swVersion="4.6.4" x-pid="2235" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.
Aug 27 06:25:02 ks3309528 rsyslogd: [origin software="rsyslogd" swVersion="4.6.4" x-pid="2235" x-info="http://www.rsyslog.com"] rsyslogd was HUPed, type 'lightweight'.
Aug 27 06:25:02 ks3309528 /USR/SBIN/CRON[3862]: (CRON) error (grandchild #3867 failed with exit status 1)
Aug 27 06:25:02 ks3309528 /USR/SBIN/CRON[3862]: (CRON) info (No MTA installed, discarding output)
Aug 27 06:25:02 ks3309528 /USR/SBIN/CRON[3864]: (CRON) info (No MTA installed, discarding output)
Aug 27 06:26:01 ks3309528 /USR/SBIN/CRON[4102]: (root) CMD (/usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:26:01 ks3309528 /USR/SBIN/CRON[4103]: (root) CMD (root /usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:26:01 ks3309528 /USR/SBIN/CRON[4101]: (CRON) error (grandchild #4103 failed with exit status 127)
Aug 27 06:27:01 ks3309528 /USR/SBIN/CRON[4149]: (root) CMD (/usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:27:01 ks3309528 /USR/SBIN/CRON[4150]: (root) CMD (root /usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:27:01 ks3309528 /USR/SBIN/CRON[4147]: (CRON) error (grandchild #4150 failed with exit status 127)
Aug 27 06:28:01 ks3309528 /USR/SBIN/CRON[4195]: (root) CMD (/usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:28:01 ks3309528 /USR/SBIN/CRON[4196]: (root) CMD (root /usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:28:01 ks3309528 /USR/SBIN/CRON[4194]: (CRON) error (grandchild #4196 failed with exit status 127)
Aug 27 06:29:01 ks3309528 /USR/SBIN/CRON[4244]: (root) CMD (root /usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:29:01 ks3309528 /USR/SBIN/CRON[4245]: (root) CMD (/usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:29:01 ks3309528 /USR/SBIN/CRON[4242]: (CRON) error (grandchild #4244 failed with exit status 127)
Aug 27 06:30:01 ks3309528 /USR/SBIN/CRON[4292]: (root) CMD (/usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:30:01 ks3309528 /USR/SBIN/CRON[4291]: (root) CMD (root /usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:30:01 ks3309528 /USR/SBIN/CRON[4289]: (CRON) error (grandchild #4291 failed with exit status 127)
Aug 27 06:31:01 ks3309528 /USR/SBIN/CRON[4338]: (root) CMD (root /usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:31:01 ks3309528 /USR/SBIN/CRON[4339]: (root) CMD (/usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:31:01 ks3309528 /USR/SBIN/CRON[4336]: (CRON) error (grandchild #4338 failed with exit status 127)
Aug 27 06:32:01 ks3309528 /USR/SBIN/CRON[4384]: (root) CMD (/usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)
Aug 27 06:32:01 ks3309528 /USR/SBIN/CRON[4385]: (root) CMD (root /usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null)

Gostaria de saber se existe uma tarefa do cron para não funcionar no vácuo ...

Eu também postei /var/log/auth.log :

Aug 27 06:25:02 ks3309528 CRON[3862]: pam_unix(cron:session): session closed for user root
Aug 27 06:25:02 ks3309528 CRON[3864]: pam_unix(cron:session): session closed for user root
Aug 27 06:26:01 ks3309528 CRON[4100]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 27 06:26:01 ks3309528 CRON[4101]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 27 06:26:01 ks3309528 CRON[4101]: pam_unix(cron:session): session closed for user root
Aug 27 06:26:01 ks3309528 CRON[4100]: pam_unix(cron:session): session closed for user root
Aug 27 06:27:01 ks3309528 CRON[4146]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 27 06:27:01 ks3309528 CRON[4147]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 27 06:27:01 ks3309528 CRON[4147]: pam_unix(cron:session): session closed for user root
Aug 27 06:27:02 ks3309528 CRON[4146]: pam_unix(cron:session): session closed for user root
Aug 27 06:28:01 ks3309528 CRON[4193]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 27 06:28:01 ks3309528 CRON[4194]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 27 06:28:01 ks3309528 CRON[4194]: pam_unix(cron:session): session closed for user root
Aug 27 06:28:01 ks3309528 CRON[4193]: pam_unix(cron:session): session closed for user root
Aug 27 06:29:01 ks3309528 CRON[4242]: pam_unix(cron:session): session opened for user root by (uid=0)
Aug 27 06:29:01 ks3309528 CRON[4241]: pam_unix(cron:session): session opened for user root by (uid=0)

Thx para você ajuda:)

EDITAR meu crontab:

root@ks3309528:~# crontab -l
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the 'crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

*/1 * * * * root /usr/local/rtm/bin/rtm 11 > /dev/null 2> /dev/null
root@ks3309528:~#

    

Answer 1

Essas linhas são relatórios do daemon linux "crond", que manipulam as tarefas agendadas para serem executadas regularmente.

Este programa em particular /usr/local/rtm/bin/rtm 11 está sendo executado a cada minuto.

O problema é que ele está sendo executado duas vezes a partir de configurações diferentes e um está com defeito. de fato, crond interpreta como um comando chamado "root" em vez de usar o usuário "root" para iniciar o comando.

Pesquise uma linha incorreta na saída crontab -l do root ou em um arquivo em /etc/cron.d/ correspondente ao padrão.

Não há motivo para que este trabalho seja lanado duas vezes, então remova aquele que falha (o que inclui root antes do comando)