4

Whenever I do cron/clear cache, that activity are shown as anonymous in log message, while my login activity are shown with my name as shown in following image.

enter image description here

Should not be user be administrator's name instead of "Anonymous(not verified)" in case of cron? Is this by design or I am missing something in config? Thanks.

  • 1
    About "all the activities" in your question: consider updating your screenprint (or adding an other one) so that it also shows an activity different from running cron. Because I cannot believe that, eg, creating a new node (by an authenticated user) is also shown as "anonymous" (which is what, IMO, your "all the activities" seems to insinuate). PS: sorry to ruin the party about this question ... – Pierre.Vriens Feb 6 '17 at 10:17
5

Running cron happens automatically when someone visits your site by default. Drupal does that automatically once every few hours to run certain cleanup/background tasks.

Additionally, cron jobs always run as anonymous user, that's why it is logged as that, even if you trigger it manually as admin.

  • Hi, yes that's what is happening, I checked manually also as administrator, although it is showing Anonymous. Is there anything concerned about security? Or this is fine? Thanks for help. – CodeNext Feb 6 '17 at 7:27
  • 2
    This is fine, as I said, this is normal and enforced – Berdir Feb 6 '17 at 7:31
  • Not to hijack your answer to post a new question, but what about all the activities different from running cron (as in the question)? – Pierre.Vriens Feb 6 '17 at 10:27
  • Well, the question only contains a single example. I can't comment on others that I don't know about. – Berdir Feb 6 '17 at 11:17
  • With the updated question from a few mins ago, the question now seems to have been made compliant with your answer. Sorry about my prior comment about those "all the activities" (as OPer wrote in the prior version of the question). – Pierre.Vriens Feb 6 '17 at 12:06
5

Why Recent log message is showing anonymous user?

because

// Force the current user to anonymous to ensure consistent permissions on cron runs.

You can see code here.

$this->accountSwitcher->switchTo(new AnonymousUserSession());

Any current user will be switch to anonymous user.

Anyone have cron url with token can run cron. You can find url at admin/config/system/cron. And cron task will auto with you setting auto cron.

0

Some times some user who is not login/anonymous user try to do some activities with the system and those restricted activities logged in the system. This activity may done by the spam user as well.

Yes definitely you need to stop this action.
I think you need to check

/sites/default/settings.php should definitely have:

$update_free_access = FALSE;

Drupal Security Tip: disabling anonymous access to cron

Secure cron.php

  • Hi, I just did check it is it is $settings['update_free_access'] = FALSE; in settings.phop file. Is it Ok? – CodeNext Feb 6 '17 at 6:05
  • You need to check the link i have paste as well. – DRUPWAY Feb 6 '17 at 6:07
  • Hi, just I forget to mention it is Drupal 8, I am checking both your links, but both are old, before D8. So just thought to inform you, if still it is true for D8, that is fine. Thanks – CodeNext Feb 6 '17 at 7:21
  • 1
    This is wrong: It's Drupal to switch the current user with the anonymous user. It has been so since Drupal 6, or even earlier. – kiamlaluno Feb 6 '17 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.