Re: logcheck

[Art Sackett <asackett@artsackett.com>]

On Tue, Sep 19, 2000 at 06:03:48PM -0500, debian-isp@ghost.net.cfw.com wrote:
> Hey Guys,
> Do any of you know what may have caused this message in my syslogs?
> 
> Unusual System Events
> =-=-=-=-=-=-=-=-=-=-=
> Sep 19 06:25:02 ghost su[322]: + ??? root-nobody 
> Sep 19 06:25:02 ghost PAM_unix[322]: (su) session opened for user nobody
> by (uid=0)

Likely, it's logrotate or somebody else who starts as nobody but
has to get root to move things around.

At least, that's the normal, non-threatening thing that probably
happens every morning at about the same time, I'd guess.

-- 
----   Art Sackett   ----