1

I looked at my auth log to see if bots were attempting to gain access and I saw a cronjob that seems to be running but I cannot see why. This is what the auth log looks like...

Dec  7 13:55:01 myuser CRON[7362]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec  7 13:55:01 myuser CRON[7362]: pam_unix(cron:session): session closed for user root
Dec  7 14:05:01 myuser CRON[7385]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec  7 14:05:01 myuser CRON[7385]: pam_unix(cron:session): session closed for user root
Dec  7 14:15:01 myuser CRON[7408]: pam_unix(cron:session): session opened for user root by (uid=0)
Dec  7 14:15:01 myuser CRON[7408]: pam_unix(cron:session): session closed for user root

so it is running every ten minutes on the dot. When I look at my root crontab I see this.

#0      0       *       *       *       job.sh
0       0       *       *       *       job2.sh
#0      23      *       *       *       job3.sh
0       0       */10    *       *       job4.sh
0       0       */5     *       *       job5.sh

Some jobs are commented out on purpose. I see only one things that has a */10 interval but that is in the day column not the minute column....Any idea where I can look next?

sudo -u root crontab -l:

#0  0   *   *   *   job.sh
0   0   *   *   *   job2.sh
#0  23  *   *   *   job3.sh
0   0   */10    *   *   job4.sh
0   0   */5 *   *   job5.sh

/etc/crontab:

# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#

I did a cat * of the cron.d dir and edited out all comments and got this:

57 0 * * 0 root if [ -x /usr/share/mdadm/checkarray ] && [ $(date +\%d) -le 7 ]; then /usr/share/mdadm/checkarray --cron --all --idle --quiet; fi
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
31 21 * * *   root    test -x /etc/cron.daily/popularity-contest && /etc/cron.daily/popularity-contest --crond
PATH=/usr/lib/sysstat:/usr/sbin:/usr/sbin:/usr/bin:/sbin:/bin
5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1
59 23 * * * root command -v debian-sa1 > /dev/null && debian-sa1 60 2
  • Add the output of sudo -u root crontab -l, /etc/crontab, and also check all files in /etc/cron.d/ – heemayl Dec 7 '16 at 5:38
  • added...there seems to be one in the cron.d dir but IDK what it is – deltaskelta Dec 7 '16 at 5:49
2

As seen, these are from:

5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1

and the command debian-sa1 (/usr/lib/sysstat/debian-sa1), is basically a wrapper script, is from the sysstat package. The filename in /etc/cron.d/ should be sysstat.

More confirmation:

% dpkg -S /usr/lib/sysstat/debian-sa1
sysstat: /usr/lib/sysstat/debian-sa1

% dpkg -S /etc/cron.d/sysstat 
sysstat: /etc/cron.d/sysstat

and the comment above the line is:

# Activity reports every 10 minutes everyday
5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1

debian-sa1 is calling /usr/lib/sysstat/sa1 which in turn is calling sadc eventually.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.