What does this (root) CMD line in system.log mean? Why is it there?

What does it mean?

(root) CMD (  [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f -cmin +$(/usr/lib/php5/maxlifetime) ! -execdir fuser -s {} 2>/dev/null \; -delete)

Found it in system.log.

Solution 1:

You chopped up part of the log line, which would provide more context about what this means.

It would be something like:

syslog:Mar 12 10:17:01 hostname CRON[4154]: (root) CMD (  [ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f -cmin +$(/usr/lib/php5/maxlifetime) ! -execdir fuser -s {} 2>/dev/null \; -delete)

The fact that it says CRON indicates it was generated by the cron periodic execution daemon. After the colon, you see it executed a command as the root user. The command was the thing in the parentheses after CMD.

When you install PHP it adds a crontab entry to clean up stale sessions, which is run by the crontab daemon. Other than the cron-related information I mentioned, the command itself verifies that /usr/lib/php5/maxlifetime and /var/lib/php5 exist, then uses the find command to locate session files under /var/lib/php5 older than the number contained in /usr/lib/php5/maxlifetime, which it then deletes.

This is the command itself:

[ -x /usr/lib/php5/maxlifetime ] && [ -d /var/lib/php5 ] && find /var/lib/php5/ -depth -mindepth 1 -maxdepth 1 -type f -cmin +$(/usr/lib/php5/maxlifetime) ! -execdir fuser -s {} 2>/dev/null \; -delete

If you want to understand it better, I suggest reading this for the conditions at the beginning:

http://tldp.org/HOWTO/Bash-Prog-Intro-HOWTO.html

then this answer for basics of find:

How can I use find command more efficiently?

If your question is about whether this command is safe, then yes, it's not a security risk of any kind and is perfectly safe to see this run periodically.

Solution 2:

This cron job is scheduled in /etc/cron.d/php5 file.