Security question regarding root email

[Jeff Vian]

On Mon, 2006-01-02 at 07:14 -0700, Craig White wrote:
> On Mon, 2006-01-02 at 07:21 -0600, Charles Howse wrote:
> > > On 1/1/06, John Summerfied <debian at herakles.homelinux.org> wrote:
> > >> Dotan Cohen wrote:
> > >>> I haven't read root's email in about a month. Now that I get around to
> > >>> it, I am suprised to see things that I have never seen before, such
> > >>> as:
> > >>>  --------------------- pam_unix Begin ------------------------
> > >>>  kde-np:
> > >>>     Unknown Entries:
> > >>>        session opened for user dotancohen by (uid=0): 1 Time(s)
> > >>>  ---------------------- pam_unix End -------------------------
> > >>> 
> > >>>  --------------------- Smartd Begin ------------------------
> > >>>  **Unmatched Entries**
> > >>>  smartd received signal 15: Terminated
> > >>>  smartd is exiting (exit status 0)
> > >>>  ---------------------- Smartd End -------------------------
> > >>> 
> > >>>  --------------------- Selinux Audit Begin ------------------------
> > >>>   Number of audit daemon starts: 1
> > >>>   Number of audit daemon stops: 2
> > >>>  *** Logs which could mean a bug ***
> > >>>     major=252 name_count=0: freeing multiple contexts (1)
> > >>>     major=113 name_count=0: freeing multiple contexts (2)
> > >>>  ---------------------- Selinux Audit End -------------------------
> > >>> 
> > >>>  --------------------- SSHD Begin ------------------------
> > >>>  SSHD Killed: 1 Time(s)
> > >>>  SSHD Started: 1 Time(s)
> > >> Normal restart stuff here and in some other places.
> > >> 
> > > 
> > > Do you mean that this is logged when the computer restarts? Because I
> > > have never restarted SSH.
> > 
> > Yes, logged when computer restarts.
> > 
> ----
> No - I don't think so.
> 
> a yum update probably updated openssh and part of the the install script
> is to restart sshd
> 
> Craig
> 

It most assuredly is logged with a reboot.  I have systems that I reboot
without an update involved and this gets logged _every_ time.

It also gets logged at other times as well (such as when the daemon gets
restarted during an update).