I noticed this in a /var/log/auth.log.

Oct 24 12:50:01 0 CRON[5764]: pam_unix(cron:session): session opened for user root by (uid=0)

What is going on?

Seems like it’s just a cron script that’s opening a root session

https://askubuntu.com/questions/465544/why-do-i-see-a-cron-session-opening-and-closing-every-hour-in-var-log-auth-log