Basic Log Analysis for Beginners
I'm learning sys administration using a Linode (Ubuntu 8.04). I'm in the chapter of keeping an eye on the most important log files.
Apart from the regular log output, I have some lines that I can't understand… even after searching the forums or asking google.
1. auth.log
Sep 5 03:17:01 serverone CRON[7929]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 5 03:17:01 serverone CRON[7929]: pam_unix(cron:session): session closed for user root
Sep 5 04:17:01 serverone CRON[7932]: pam_unix(cron:session): session opened for user root by (uid=0)
Sep 5 04:17:02 serverone CRON[7932]: pam_unix(cron:session): session closed for user root
As you can see, in the 17th minute of every hour, even if I'm logged in, those keep appearing in the auth.log.
2. messages/syslog
Sep 5 00:19:56 serverone kernel: [UFW BLOCK INPUT]: IN=eth0 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=xxx.xxx.xxx.xxx DST=xxx.xxx.xxx.xxx LEN=48 TOS=0x00 PREC=0x00 TTL=116 ID=14332 DF PROTO=TCP SPT=1633 DPT=5900 WINDOW=64240 RES=0x00 SYN URGP=0
Everyday messages and syslog log around 200 attempts of intrusion (??) blocked by ufw… but I think I shouldn't be concerned, since I've just a custom SSH port and HTTP:80 open. Am I right?
3. syslog
Sep 5 16:25:32 serverone dhclient: DHCPREQUEST of <null address=""> on eth0 to xxx.xxx.xxx.xxx port 67
Sep 5 16:25:32 serverone dhclient: DHCPACK of xxx.xxx.xxx.xxx from xxx.xxx.xxx.xxx
Sep 5 16:25:32 serverone dhclient: bound to xxx.xxx.xxx.xxx -- renewal in 35962 seconds.</null>
These lines are the most strange ones and I think they're related with Linode's Ubuntu. I can't find their meaning!
4. syslog
Sep 5 21:17:01 serverone /USR/SBIN/CRON[8598]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly)
I think this line is related with the auth.log problem as it happens every 17th minute of each hour.
I'll be much appreciated if you can give some enlightenment around the described issues. Thanks a lot.
3 Replies
Number 2 is indeed a firewall hit… someone at SRC port SPT tried to connect to you, DST, on port DPT. The "UFW BLOCK INPUT" indicates that it was blocked, so it can be safely ignored.
Number 3 is the DHCP client on your system renewing the lease of its IP address. This is also normal.
So, yep, normal routine system chatter
Regarding 1 and 4, I checked the /etc/crontab and, indeed, there's a job running every hour on minute 17.
# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
