So I've excluded the applicable local users that were making requests in the users.ignore file. This leaves the following log snippit running over and over again, just with different scripts (again, only under /var/spool/cron) as the requested name:
Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <main> daemon.ipcserver Accepted new lrpc2 client on <fd:23> with flags 0x00000802 Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > daemon.ipcclient2 executing request 'NSSGetPasswdDataByName' in thread 139707076606272 Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > daemon.ipcclient2 Getting passwd data for 'SWT_TRIP_REPORT-1355.sql' Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.adagent Find GUID: 3cb46ac1dd2c4ae49e294e4bf2f6b62b (7) Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.objecthelper age 471, expire age 3600, cutoff time 0, refresh 5, negative=true, cacheOps 7 Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.adagent findObject ADNames: SWT_TRIP_REPORT-1355.sql name: SWT_TRIP_REPORT-1355.sql type=SAM domain=STARTRAK.COM Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.bind.cache ADCB::search base , filter (&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))(sAMAccountName=SWT_TRIP_REPORT-1355.sql)), attrs 2 (cacheOps=7, GC=0) Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.objecthelper age 471, expire age 3600, cutoff time 0, refresh 5, negative=true, cacheOps 7 Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.bind.cache ADCB::search base , filter (&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))(sAMAccountName=SWT_TRIP_REPORT-1355.sql)), attrs 1e (cacheOps=7, GC=1) Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.objecthelper age 471, expire age 3600, cutoff time 0, refresh 5, negative=true, cacheOps 7 Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.adagent findByAttr: Not Found:SWT_TRIP_REPORT-1355.sql category:user attr=sAMAccountName Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.bind.cache ADCB::search base , filter (&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))(displayName=SWT_TRIP_REPORT-1355.sql)), attrs 2 (cacheOps=7, GC=0) Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.objecthelper age 471, expire age 3600, cutoff time 0, refresh 5, negative=true, cacheOps 7 Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.bind.cache ADCB::search base , filter (&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))(displayName=SWT_TRIP_REPORT-1355.sql)), attrs 1e (cacheOps=7, GC=1) Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.objecthelper age 471, expire age 3600, cutoff time 0, refresh 5, negative=true, cacheOps 7 Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.adagent findByAttr: Not Found:SWT_TRIP_REPORT-1355.sql category:user attr=displayName Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.bind.cache ADCB::search base , filter (&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))(cn=SWT_TRIP_REPORT-1355.sql)), attrs 2 (cacheOps=7, GC=0) Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.objecthelper age 471, expire age 3600, cutoff time 0, refresh 5, negative=true, cacheOps 7 Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.bind.cache ADCB::search base , filter (&(objectClass=User)(|(objectCategory=Person)(objectCategory=Computer))(cn=SWT_TRIP_REPORT-1355.sql)), attrs 1e (cacheOps=7, GC=1) Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.objecthelper age 471, expire age 3600, cutoff time 0, refresh 5, negative=true, cacheOps 7 Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.adagent findByAttr: Not Found:SWT_TRIP_REPORT-1355.sql category:user attr=cn Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.adagent findObject: NotFound:SWT_TRIP_REPORT-1355.sql Category:user Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > base.objecthelper 'SWT_TRIP_REPORT-1355.sql' is not a canonical name Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > util.except (NotFound) : No such unix user 'SWT_TRIP_REPORT-1355.sql' (reference ipcclient2.cpp:936 rc: 0) Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > daemon.ipcclient2 No user data: No such unix user 'SWT_TRIP_REPORT-1355.sql' Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <fd:23 NSSGetPasswdDataByName > daemon.ipcclient2 request 'NSSGetPasswdDataByName' complete Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <main> daemon.ipcserver Accepted new lrpc2 client on <fd:24> with flags 0x00000802 Aug 12 15:40:01 tms-oda1-nd1 adclient[38720]: DEBUG <main> daemon.ipcserver lrpc client disconnected normally <fd:23>
Can you help me digest what is taking place here? There's no associated PID or UID. How do I tell what's calling the adclient? Also, is there an explainer for the debug log file and what the fields and values mean? Like fd:23?