Hi list!
On all my 4.x boxes (didn't see this on 3.x) I get this in /var/log/messages the whole day:
Aug 17 04:02:05 weblinux1 crond(pam_unix)[32149]: session closed for user root Aug 17 05:01:01 weblinux1 crond(pam_unix)[32668]: session opened for user root b y (uid=0) Aug 17 05:01:01 weblinux1 crond(pam_unix)[32668]: session closed for user root Aug 17 06:01:01 weblinux1 crond(pam_unix)[32712]: session opened for user root b y (uid=0) Aug 17 06:01:01 weblinux1 crond(pam_unix)[32712]: session closed for user root Aug 17 07:01:01 weblinux1 crond(pam_unix)[32762]: session opened for user root b y (uid=0) Aug 17 07:01:01 weblinux1 crond(pam_unix)[32762]: session closed for user root Aug 17 08:01:01 weblinux1 crond(pam_unix)[344]: session opened for user root by (uid=0)
Logwatch reports it too every day:
crond: Unknown Entries: session closed for user root: 25 Time(s) session opened for user root by (uid=0): 25 Time(s)
Some boxes have up to 770 of these events per day