why is cron flooding wtmp and last?

Question

When I type the last command, I see a bunch of entries in there for cron. Every single cron job that gets run creates an entry and it's flooding wtmp with unnecessary entries. Any ideas how I can stop cron from doing that? The entries look like the following:

root cron Sat Feb 06 12:50 - 12:50 (00:00) root cron Sat Feb 06 12:40 - 12:40 (00:00) root cron Sat Feb 06 12:30 - 12:30 (00:00) myuser pts/0 :0.0 Sat Feb 06 10:30 - 12:30 (02:00)

Check your system clock. It appears you have it set to the wrong _year_. — Michael Hampton, Feb 08 '15 at 01:34
thanks, but no, that's not it. i had to type it in manually because these servers are on an isolated network. i just copied and pasted the same line with a typo over and over — chizou, Feb 08 '15 at 02:57
check your cronjobs. a cronjob might spawn a login-shell to execute a command — andrekeller, Feb 08 '15 at 21:50

score 2 · Accepted Answer · answered Jun 27 '17 at 15:40

This is likely done by your pam configuration. Check either /etc/pam.conf or the files in /etc/pam.d/* for lines containing pam_lastlog.so. From the pam_lastlog(8) manual:

DESCRIPTION
pam_lastlog is a PAM module to display a line of information about the last login of the user. In addition, the module maintains the /var/log/lastlog file.

The exact solution depends on your overall pam configuration. You can either tell pam_lastlog no not write to /var/log/wtmp or you can skip pam_lastlog only for cron sessions.

why is cron flooding wtmp and last?

1 Answers1