Kai Schaetzl wrote: >Sam Drinkard wrote on Thu, 15 Dec 2005 13:29:00 -0500: > > > >>Just curious why it's now shown as a false start/end where >>before, it was not. >> >> > >Hm, did you ever get a "pam_unix" report before? The first thing that >comes to mind is that this check must be going wild and accidentally not >closing before the next should start or so. I haven't ever seen such a >section. Did you check your messages log for unusual pam logging lines? >Another option could be to remove all the checks that are before cron (or >including cron). If you look at /usr/share/logwatch/scripts services you >can see quite a few other check in alphabetical order. Maybe one of them >gulps over some log stuff. You could remove them plus the corresponding >files in default.conf/* temporarily and see if it stops. >Or dare to install a newer Logwatch? The one in Centos 4 is quite old. >Logwatch is now at 7.1 and you can install it via rpm. I installed it just >a few days ago on several of our machines since it finally looks mature. > >Kai > > > Yep.. I get the pam_unix reports in the logwatch every morning. The cron job runs at I believe, 0402L. I'm not _aware_ of any changes to anything, and nothing has been updated in the last few days, or since these falses have been showing up. I looked at all the logfiles this afternoon, and did not see anything any different from any other times, plus the date entries are all within a range of 11 dec to 14 dec. /etc/log.d/logwatch script seemed to be normal, with no additions or deletions, and come to think of it, I perhaps did cause some problem without knowing by removing a couple of files owned by me in /tmp. They were some logs of a software package running on this machine, but I can't put a connection between the two. Was not aware there is a new logwatch script, but I suppose it would not hurt to look it over and see what, if anything changes. I do rely on the logs to know what is happening to the system at night when I'm in the arms of morpheus, and have caught several events or precursor events that might cause problems. That particular entry(s) is the only thing different from all prior logs. As long as the machine is not misbehaving, I'll not loose too much sleep over it at the moment. Sam -- Snowman