Pam loginuid(crond:session): set loginuid failed opening loginuid
root@hostname [~]# tail /var/log/messages
Jan 15 13:30:01 vmlinux1 cron: pam_loginuid(crond:session): set_loginuid failed
Jan 15 13:30:01 vmlinux1 cron: Cannot make/remove an entry for the specified session
Logwatch occur when using a non-standard kernel without the correct CONFIG_AUDIT and CONFIG_AUDITSYSCALL options set. If you're running a kernel without those options then you can remove the pam_loginuid from PAM (sshd,crond,login,remote and possibly others)
Method 1, grep and comment out the following pam_loginuid.so call
root@hostname [~]# grep pam_loginuid.so /etc/pam.d/*
/etc/pam.d/crond:session required pam_loginuid.so
/etc/pam.d/login:session required pam_loginuid.so
/etc/pam.d/remote:session required pam_loginuid.so
/etc/pam.d/sshd:session required pam_loginuid.so
Method 2, if logwatch only related to crond, comment crond from pam config only
root@hostname [~]# more /etc/pam.d/crond
- The PAM configuration file for the cron daemon
auth sufficient pam_rootok.so
auth include common-auth
account include common-account
password include common-password
- session required pam_loginuid.so
session include common-session
