Orphan (no passwd entry)

[MikeUN]

What does this mean coming out of the Log Watch emails I get daily?


--------------------------------------
**Unmatched Entries**
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)
ORPHAN (no passwd entry)

-------------------------------------

I'm getting several more each day (started with one or two, going up to about 12 now)

Thanks,
Mike

 

[Traged1]

These are orphaned cron jobs, that were not removed when users were deleted from the system. when using redhat OS's have a look in the following locations for any jobs that are setup for which actual users do not exist anymore:

/var/spool/cron
/etc/crontab
/etc/cron.hourly
/etc/cron.daily
/etc/cron.weekly
/etc/cron.monthly

 

[Traged1]

A possible reason as to why these cron jobs got orphaned may be that your manually remove a user, or you renamed a user or domain which had a cron job running.

 

[Traged1]

You might have this also if you manually edited the root cron file in /var/spool/cron as redhat systems will create a backup file named root~ and this will be executed as a job, but since there is no user named root~ it is considered an orphan.

You can easily find these with this command in console or SSH:

grep ORPHAN /var/log/cron