Neil,
Neil Marjoram wrote:
I am a bit concerned about what appears to be a login every three minutes on my server. Can anyone help with this? Heres a bit of my log :(host is the servers hostname)
Nov 4 08:17:54 host sshd(pam_unix)[2945]: session opened for user root by (uid=0) Nov 4 08:17:55 host sshd(pam_unix)[2945]: session closed for user root Nov 4 08:20:55 host sshd(pam_unix)[2991]: session opened for user root by (uid=0) Nov 4 08:20:55 host sshd(pam_unix)[2991]: session closed for user root Nov 4 08:23:56 host sshd(pam_unix)[3035]: session opened for user root by (uid=0) Nov 4 08:23:56 host sshd(pam_unix)[3035]: session closed for user root Nov 4 08:26:56 host sshd(pam_unix)[3205]: session opened for user root by (uid=0) Nov 4 08:26:57 host sshd(pam_unix)[3205]: session closed for user root Nov 4 08:29:57 host sshd(pam_unix)[3249]: session opened for user root by (uid=0) Nov 4 08:29:57 host sshd(pam_unix)[3249]: session closed for user root
Do you have any kind of monitoring tool (e.g. nagios) running on that server that checks the exitens of your sshd? We have nagios running here and my logfile is packed w/those messages.
Thanks,
Neil.
Just a best gues.
Alex
