logcheck report flooded with cron session lines

[Romwriter]

Ubuntu 24.04 / logcheck 1.4.3. No rsyslog installed, pure journal.

logcheck floods reports with the following lines:

...
Mär 30 05:35:01 ad525 CRON[14991]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
Mär 30 05:39:01 ad525 CRON[15004]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
Mär 30 05:45:01 ad525 CRON[15067]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
Mär 30 05:55:01 ad525 CRON[15102]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
Mär 30 06:05:01 ad525 CRON[15131]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
Mär 30 06:09:01 ad525 CRON[15144]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
Mär 30 06:15:01 ad525 CRON[15205]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
Mär 30 06:17:01 ad525 CRON[15212]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)
...

There is a line in /etc/logcheck/ignore.d.server/logcheck that reads

^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ([[:alnum:]]+\[[0-9]+\])?: \(pam_[[:alnum:]]+\) session opened for user [.[:alnum:]-]+ by (root|LOGIN)?\(uid=0\)$

I guess it should read

^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ ([[:alnum:]]+\[[0-9]+\])?: \(pam_[[:alnum:]]+\) session opened for user [.[:alnum:]-]+(\(uid=[0-9]+\))? by (root|LOGIN)?\(uid=0\)$

(additional line or modified line?)

ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: logcheck 1.4.3
ProcVersionSignature: Ubuntu 6.8.0-11.11-generic 6.8.0-rc4
Uname: Linux 6.8.0-11-generic x86_64
ApportVersion: 2.28.0-0ubuntu1
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Sun Mar 31 11:43:07 2024
PackageArchitecture: all
ProcEnviron:
 LANG=de_DE.UTF-8
 PATH=(custom, no user)
 SHELL=/bin/bash
 TERM=xterm-256color
 XDG_RUNTIME_DIR=<set>
SourcePackage: logcheck
UpgradeStatus: No upgrade log present (probably fresh install)
modified.conffile..etc.cron.d.logcheck: [modified]
modified.conffile..etc.init.d.apport: [modified]
modified.conffile..etc.logcheck.logcheck.conf: [modified]
mtime.conffile..etc.cron.d.logcheck: 2017-06-17T22:04:13.003673
mtime.conffile..etc.init.d.apport: 2024-02-22T15:20:00
mtime.conffile..etc.logcheck.logcheck.conf: 2023-09-08T09:36:21.031072

[Robie Basak (racb)]

Thank you for reporting this bug and helping to make Ubuntu better.

As far as I can tell, the line you've provided should be matched by the following line, from /etc/logcheck/ignore.d.paranoid/cron:

^(\w{3} [ :0-9]{11}|[0-9T:.+-]{32}) [._[:alnum:]-]+ CRON\[[0-9]+\]: pam_[[:alnum:]]+\(cron:session\): session (opened|closed) for user [[:alnum:]-]+(\(uid=[[:digit:]]+\))?( by \(uid=[0-9]+\))?$

For my locale I used this as test log file input:

Apr 05 14:57:01 logcheck CRON[6191]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)

I created this by creating a cronjob to run every minute. After the log line appeared, I also tried "sudo -u logcheck logcheck -o -t" and the line was *not* reported (matching expected behaviour).

Additionally, logcheck-test output is as follows:

# logcheck-test -q -l ~/test.log -r /etc/logcheck/ignore.d.paranoid/cron && echo match
Apr 05 14:57:01 logcheck CRON[6191]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
match

So it looks like that line is matching as expected.

logcheck(8) says:

> The ignore rules work in additive manner. "paranoid" rules are also included at level "server". "workstation" level includes both "paranoid" and "server" rules.

Therefore, if it matches paranoid rules, it should be sufficient for all settings. I see from your report that you have extensive logcheck configuration customisations. Is this interfering with this expectation somehow?

It might be that ignore.d.server/logcheck could be improved with the newer PAM patterns, but to justify making a specific change in Ubuntu directly I need a specific failure case that I can reproduce please. Otherwise, code quality improvements should probably be sent as merge requests directly to https://salsa.debian.org/debian/logcheck instead.

Since I cannot reproduce the behaviour you're experiencing, I'm marking the bug as Incomplete for Ubuntu. If this turns out to be a local configuration issue, please set the status as Invalid. If you can provide steps to reproduce or have a correction to make to my analysis, please do that in a comment and then change the status back to New. Thanks!

[Romwriter (romwriter)]

Hi Robie, Thank you for digging into this. There is a difference in the log entries posted by the cron service. On my system, it does post

Apr 05 14:57:01 logcheck CRON[6191]: pam_unix(cron:session): session opened for user root(uid=0) by root(uid=0)

while on your system, it does post

Apr 05 14:57:01 logcheck CRON[6191]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)

which differs in the second occasion of the user name.

"apt list cron --installed" says:
cron/noble,now 3.0pl1-184ubuntu2 amd64

I have no idea where to configure the format of the logging entries, nor have I modified /etc/crontab, /usr/lib/systemd/system/cron.service or /etc/default/cron. Can you give a hint where to search?

[Robie Basak (racb)]

Ah sorry, I think I know what this is. Let me look again.