Coisas estranhas no meu /vair/log/auth.log

Eu apenas viewifique meus logs em meu server de ações, vi alguns logs esquisitos no auth.log :

 Jun 17 22:27:01 mutualab CRON[16249]: pam_unix(cron:session): session opened for user user by (uid=0) Jun 17 22:27:01 mutualab CRON[16249]: pam_unix(cron:session): session closed for user user Jun 17 22:28:01 mutualab CRON[16253]: pam_unix(cron:session): session opened for user user by (uid=0) Jun 17 22:28:01 mutualab CRON[16253]: pam_unix(cron:session): session closed for user alain Jun 17 22:29:01 mutualab CRON[16257]: pam_unix(cron:session): session opened for user user by (uid=0) Jun 17 22:29:01 mutualab CRON[16257]: pam_unix(cron:session): session closed for user user 

Pairece que alguém tentou se conectair – e conseguiu? – mas delog instantaneamente? Eu tenho o mesmo registro por horas agora …

Você sabe o que acontece?