Root session opened every 3 minutes

[Neil Marjoram]

No, not yet. So it's a bit worrying.

Neil.
On Thu, 2004-11-04 at 09:54, Alexander Apprich wrote:
> Neil,
> 
> Neil Marjoram wrote:
> > I am a bit concerned about what appears to be a login every three
> > minutes on my server. Can anyone help with this? Heres a bit of my log
> > :(host is the servers hostname)
> > 
> > Nov  4 08:17:54 host sshd(pam_unix)[2945]: session opened for user root
> > by (uid=0)
> > Nov  4 08:17:55 host sshd(pam_unix)[2945]: session closed for user root
> > Nov  4 08:20:55 host sshd(pam_unix)[2991]: session opened for user root
> > by (uid=0)
> > Nov  4 08:20:55 host sshd(pam_unix)[2991]: session closed for user root
> > Nov  4 08:23:56 host sshd(pam_unix)[3035]: session opened for user root
> > by (uid=0)
> > Nov  4 08:23:56 host sshd(pam_unix)[3035]: session closed for user root
> > Nov  4 08:26:56 host sshd(pam_unix)[3205]: session opened for user root
> > by (uid=0)
> > Nov  4 08:26:57 host sshd(pam_unix)[3205]: session closed for user root
> > Nov  4 08:29:57 host sshd(pam_unix)[3249]: session opened for user root
> > by (uid=0)
> > Nov  4 08:29:57 host sshd(pam_unix)[3249]: session closed for user root
> > 
> 
> Do you have any kind of monitoring tool (e.g. nagios) running on that
> server that checks the exitens of your sshd? We have nagios running here
> and my logfile is packed w/those messages.
> 
> > Thanks,
> > 
> > Neil.
> 
> Just a best gues.
> 
> Alex
-- 
Neil Marjoram.
Systems Manager
University College London
Adastral Park Campus
Martlesham Heath
Ipswich
Suffolk
IP5 3RL

01473 663711