messages 文件異常，尋求解決方法

eric-guo

下面是messages文件所顯示的內(nèi)容：
        Start up of circular syslogging
Version $Revision: 1.4 $ - Compiled on: Oct 26 2006
Max log size:  10000000



***** Log Wrap Point *****

Apr  1 06:47:03 localhost syslogd 1.4.1#16ubuntu6: restart.
Apr  1 06:52:01 localhost CRON[29126]: (pam_unix) session opened for user root by (uid=0)
Apr  1 06:52:01 localhost /USR/SBIN/CRON[29127]: (root) CMD (test-x /usr/sbin/anacron || run-parts --report /etc/cron.monthly)
Apr  1 06:52:01 localhost CRON[29126]: (pam_unix) session closed for user root
Apr  1 07:07:03 localhost -- MARK --
Apr  1 07:17:01 localhost CRON[13935]: (pam_unix) session opened for user root by (uid=0)
Apr  1 07:17:01 localhost /USR/SBIN/CRON[13936]: (root) CMD (   run-parts --report /etc/cron.hourly)
Apr  1 07:17:01 localhost CRON[13935]: (pam_unix) session closed for user root
Apr  1 07:27:03 localhost -- MARK --
Apr  1 07:47:03 localhost -- MARK --
Apr  1 08:07:03 localhost -- MARK --
Apr  1 08:17:01 localhost CRON[22400]: (pam_unix) session opened for user root by (uid=0)
Apr  1 08:17:01 localhost /USR/SBIN/CRON[22401]: (root) CMD (   run-parts --report /etc/cron.hourly)
Apr  1 08:17:01 localhost CRON[22400]: (pam_unix) session closed for user root
Apr  1 08:27:03 localhost -- MARK --
Apr  1 08:47:03 localhost -- MARK --
Apr  1 09:07:03 localhost -- MARK --
Apr  1 09:17:01 localhost CRON[30811]: (pam_unix) session opened for user root by (uid=0)
Apr  1 09:17:01 localhost /USR/SBIN/CRON[30812]: (root) CMD (   run-parts --report /etc/cron.hourly)
Apr  1 09:17:01 localhost CRON[30811]: (pam_unix) session closed for user root
Apr  1 09:27:03 localhost -- MARK --
Apr  1 09:47:03 localhost -- MARK --
Apr  1 10:07:03 localhost -- MARK --
    .
    .
    . 以下重復(fù)
Apr  2 06:17:01 localhost CRON[17689]: (pam_unix) session opened for user root by (uid=0)
Apr  2 06:17:01 localhost /USR/SBIN/CRON[17690]: (root) CMD (   run-parts --report /etc/cron.hourly)
Apr  2 06:17:01 localhost CRON[17689]: (pam_unix) session closed for user root
Apr  2 06:25:01 localhost CRON[23103]: (pam_unix) session opened for user root by (uid=0)
Apr  2 06:25:01 localhost /USR/SBIN/CRON[23104]: (root) CMD (test-x /usr/sbin/anacron || run-parts --report /etc/cron.daily)
Apr  2 06:25:02 localhost su[23134]: + ??? root:nobody
Apr  2 06:25:02 localhost su[23134]: (pam_unix) session opened for user nobody by (uid=0)
Apr  2 06:25:24 localhost exiting on signal 15
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A
A

N 個(gè)重復(fù)

A
A
A


***** End of Log *****


為什么會(huì)是這個(gè)樣子？ 什么地方出問(wèn)題了呢？ 謝謝各位了

huaping3263

只能幫你頂一下了.....................

roger_3301

USR/SBIN/CRON[13936]: (root) CMD (   run-parts --report /etc/cron.hourly)
是不是cron啟的不對(duì)��？我也是猜測(cè)的

lunchan

sudoer有nobody不?有的話##了他

terry5168

樓上的回答應(yīng)該有點(diǎn)關(guān)系，但是這個(gè)如果打開與否只會(huì)影響登錄時(shí)的信息。建議檢查一下/etc/security/pam.xml文件名記不清了。。sorry。。。把和messages里面的錯(cuò)誤session提示刪掉。

platinum

/USR/SBIN/CRON
有這個(gè)目錄？

HonestQiao

我也奇怪，他怎么都是大寫的��？

fangjy2008

原帖由 eric-guo 于 2007-4-3 11:50 發(fā)表于 1樓  
下面是messages文件所顯示的內(nèi)容：
        Start up of circular syslogging
Version $Revision: 1.4 $ - Compiled on: Oct 26 2006
Max log size:  10000000



***** Log Wrap Point *****

Apr  1 ...

在/etc/syslog.conf里面有 /var/log/message 那行里 加上cron.none 試試看 ，這樣cron產(chǎn)生的信息就不會(huì)寫到message里面

飄雪心辰

原帖由 eric-guo 于 2007-4-3 11:50 發(fā)表于 1樓  
下面是messages文件所顯示的內(nèi)容：
        Start up of circular syslogging
Version $Revision: 1.4 $ - Compiled on: Oct 26 2006
Max log size:  10000000



***** Log Wrap Point *****

Apr  1 ...

==================
我目前看不出什么異常，下面這個(gè)是ubuntu的crontab:

root@zhao-desktop:/etc/cron.daily# cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file.
# This file also has a username field, that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || run-parts --report /etc/cron.daily
47 6    * * 7   root    test -x /usr/sbin/anacron || run-parts --report /etc/cron.weekly
52 6    1 * *   root    test -x /usr/sbin/anacron || run-parts --report /etc/cron.monthly
#

每小時(shí)的17分時(shí)動(dòng)作/etc/cron.hourly目錄，每天6點(diǎn)25分動(dòng)作cron.daily等等……等等

Apr  2 06:25:02 localhost su[23134]: + ??? root:nobody
Apr  2 06:25:02 localhost su[23134]: (pam_unix) session opened for user nobody by (uid=0)

這個(gè)應(yīng)該是crond用nobody的權(quán)限替換root執(zhí)行任務(wù)。
至于

Apr  1 08:27:03 localhost -- MARK --
Apr  1 08:47:03 localhost -- MARK --
Apr  1 09:07:03 localhost -- MARK --

每隔20分動(dòng)作一次，應(yīng)該是sysklogd程序加了一個(gè)-m的參數(shù)，

       -m interval
              The syslogd logs a mark timestamp regularly.  The default inter‐\r
              val  between  two  --  MARK -- lines is 20 minutes.  This can be
              changed with this option.  Setting the interval to zero turns it
              off entirely.