[CentOS] False begin and false end ?

[Sam Drinkard]

Kai Schaetzl wrote:

>Sam Drinkard wrote on Thu, 15 Dec 2005 13:29:00 -0500:
>
>  
>
>>Just curious why it's now shown as a false start/end where 
>>before, it was not.
>>    
>>
>
>Hm, did you ever get a "pam_unix" report before? The first thing that 
>comes to mind is that this check must be going wild and accidentally not 
>closing before the next should start or so. I haven't ever seen such a 
>section. Did you check your messages log for unusual pam logging lines?
>Another option could be to remove all the checks that are before cron (or 
>including cron). If you look at /usr/share/logwatch/scripts services you 
>can see quite a few other check in alphabetical order. Maybe one of them 
>gulps over some log stuff. You could remove them plus the corresponding 
>files in default.conf/* temporarily and see if it stops.
>Or dare to install a newer Logwatch? The one in Centos 4 is quite old. 
>Logwatch is now at 7.1 and you can install it via rpm. I installed it just 
>a few days ago on several of our machines since it finally looks mature.
>
>Kai
>
>  
>
Yep.. I get the pam_unix reports in the logwatch every morning.  The 
cron job runs at I believe, 0402L.  I'm not _aware_ of any changes to 
anything, and nothing has been updated in the last few days, or since 
these falses have been showing up.  I looked at all the logfiles this 
afternoon, and did not see anything any different from any other times, 
plus the date entries are all within a range of 11 dec to 14 dec.  
/etc/log.d/logwatch script seemed to be normal, with no additions or 
deletions, and come to think of it, I perhaps did cause some problem 
without knowing by removing a couple of files owned by me in /tmp.  They 
were some logs of a software package running on this machine, but I 
can't put a connection between the two.

Was not aware there is a new logwatch script, but I suppose it would not 
hurt to look it over and see what, if anything changes.  I do rely on 
the logs to know what is happening to the system at night when I'm in 
the arms of morpheus, and have caught several events or precursor events 
that might cause problems.

That particular entry(s) is the only thing different from all prior 
logs.  As long as the machine is not misbehaving, I'll not loose too 
much sleep over it at the moment.

Sam

-- 
Snowman