We are seeing the following audit records frequently displaying on the xSeries and opteron consoles. We don't see these when accessing remotely. audit(1121277961.150:13073995): user pid=13666 uid=0 auid=500 msg='PAM accounting: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron result=Success)' audit(1121277961.151:13074064): login pid=13666 uid=0 old auid=500 new auid=0 audit(1121277961.151:13074070): user pid=13666 uid=0 auid=0 msg='PAM session open: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron result=Success)' audit(1121277961.151:13074079): user pid=13666 uid=0 auid=0 msg='PAM setcred: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron result=Success)' audit(1121277961.156:13074258): user pid=13666 uid=0 auid=0 msg='PAM setcred: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron result=Success)' audit(1121277961.157:13074277): user pid=13666 uid=0 auid=0 msg='PAM session close: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron result=Success)' P.S. I hope this is not arriving as HTML; had to reinstall my desktop - have set default to plain text but who knows....