Question about journal log repeating entry

English Applications
1

Today found my system locked up. I could ping it but could find no response from keyboard (unless there is a secret key combo that I didn’t think of). All I could do was power down. Maybe I need to run ssh in the future to see if I can do a clean shutdown. I never did find anything in the log as su or as user that pointed to a problem that may have caused the lockup. I don’t use screen locking but I do run a screen saver, xscreensaver. When I found the system locked, of course the screensaver was frozen.

I usually don’t poke around in the log file so am not familiar with a lot of entries. I found this series of entries, repeated ev. 15 min. I don’t know if it is normal or not and would like to know what it all means. This is in the system log. This is one of many series of entries. Searching my journal I see that this series of entries first started in late May and apparently are there during every session since then.

Are these normal entries and what is their purpose?

-- Logs begin at Sun 2016-03-27 15:43:42 PDT, end at Sun 2016-12-11 19:00:01 PST. --
Dec 11 13:30:01 linux-shpr cron[6965]: pam_unix(crond:session): session opened for user root by (uid=0)
Dec 11 13:30:01 linux-shpr systemd[6966]: pam_unix(systemd-user:session): session opened for user root by (uid=0)
Dec 11 13:30:01 linux-shpr systemd[1]: Starting user-0.slice.
Dec 11 13:30:01 linux-shpr systemd[1]: Created slice user-0.slice.
Dec 11 13:30:01 linux-shpr systemd[1]: Starting User Manager for UID 0...
Dec 11 13:30:01 linux-shpr systemd[1]: Starting Session 19 of user root.
Dec 11 13:30:01 linux-shpr systemd[1]: Started Session 19 of user root.
Dec 11 13:30:01 linux-shpr systemd[6966]: Starting Paths.
Dec 11 13:30:01 linux-shpr systemd[6966]: Reached target Paths.
Dec 11 13:30:01 linux-shpr systemd[6966]: Starting Timers.
Dec 11 13:30:01 linux-shpr systemd[6966]: Reached target Timers.
Dec 11 13:30:01 linux-shpr systemd[6966]: Starting Sockets.
Dec 11 13:30:01 linux-shpr systemd[6966]: Reached target Sockets.
Dec 11 13:30:01 linux-shpr systemd[6966]: Starting Basic System.
Dec 11 13:30:01 linux-shpr systemd[6966]: Reached target Basic System.
Dec 11 13:30:01 linux-shpr systemd[6966]: Starting Default.
Dec 11 13:30:01 linux-shpr systemd[6966]: Reached target Default.
Dec 11 13:30:01 linux-shpr systemd[6966]: Startup finished in 48ms.
Dec 11 13:30:01 linux-shpr systemd[1]: Started User Manager for UID 0.
Dec 11 13:30:01 linux-shpr CRON[6965]: pam_unix(crond:session): session closed for user root
Dec 11 13:30:02 linux-shpr systemd[1]: Stopping User Manager for UID 0...
Dec 11 13:30:02 linux-shpr systemd[6966]: Stopping Default.
Dec 11 13:30:02 linux-shpr systemd[6966]: Stopped target Default.
Dec 11 13:30:02 linux-shpr systemd[6966]: Stopping Basic System.
Dec 11 13:30:02 linux-shpr systemd[6966]: Stopped target Basic System.
Dec 11 13:30:02 linux-shpr systemd[6966]: Stopping Paths.
Dec 11 13:30:02 linux-shpr systemd[6966]: Stopped target Paths.
Dec 11 13:30:02 linux-shpr systemd[6966]: Stopping Timers.
Dec 11 13:30:02 linux-shpr systemd[6966]: Stopped target Timers.
Dec 11 13:30:02 linux-shpr systemd[6966]: Stopping Sockets.
Dec 11 13:30:02 linux-shpr systemd[6966]: Stopped target Sockets.
Dec 11 13:30:02 linux-shpr systemd[6966]: Starting Shutdown.
Dec 11 13:30:02 linux-shpr systemd[6966]: Reached target Shutdown.
Dec 11 13:30:02 linux-shpr systemd[6966]: Starting Exit the Session...
Dec 11 13:30:02 linux-shpr systemd[6966]: Received SIGRTMIN+24 from PID 7069 (kill).
Dec 11 13:30:02 linux-shpr systemd[6967]: pam_unix(systemd-user:session): session closed for user root
Dec 11 13:30:02 linux-shpr systemd[1]: Stopped User Manager for UID 0.
Dec 11 13:30:02 linux-shpr systemd[1]: Stopping user-0.slice.
Dec 11 13:30:02 linux-shpr systemd[1]: Removed slice user-0.slice.
2

If I’m not mistaken,
Your post suggests you have a cron job running every 15 minutes…

TSU

3

Yes, of course. One of the problems with posting late & tired is details are sometimes left out.
I saw that it’s a cron job. I checked /etc/cron.d, and the other standard cron/* dir’s. I also looked at /var/spool/atjobs.
I’m not very good at understanding the contents of the system jobs in, for example, /etc/cron.daily
There does not seem to be anything in those dir’s that run every 15min.
If I try to list the cron jobs nothing shows up except the crontab that I myself created.

So I posted here to find out more info.

Even though it seems that the system is running this, I feel uncomfortable seeing something new that is repeating so frequently.

4

I have also noticed this while “following” the systemd journal on a 13.2 system while checking another issue I had with recurring entries.

A simple answer is: it’s PAM (Pluggable Authentication Modules for Linux)

A more complete answer is: yes, by default a cron job runs with the user ‘root’ every 15 minutes – the default “/etc/crontab” [readable only by ‘root’] contains:


SHELL=/bin/sh
PATH=/usr/bin:/usr/sbin:/sbin:/bin:/usr/lib/news/bin
MAILTO=root
#
# check scripts in cron.hourly, cron.daily, cron.weekly, and cron.monthly
#
-*/15 * * * *   root  test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons >/dev/null 2>&1

This in turn, calls the default PAM crond file located in "/etc/pam.d/:


#
# The PAM configuration file for the cron daemon
#
#
# No PAM authentication called, auth modules not needed
auth     sufficient     pam_rootok.so
account  sufficient     pam_listfile.so item=user sense=allow file=/etc/cron.allow onerr=succeed quiet
auth     include        common-auth
account  include        common-account
password include        common-password
session  required       pam_loginuid.so
session  include        common-session

Which in turn causes systemd to run and perform some housekeeping.

The 64-dollar question is: “Are all the systemd journal entries REALLY necessary?”

  • IMHO, the number of journal entries could for most purposes be reduced.