Re: strangelog

[scbarker@uiuc.edu (Steven Barker)]

On Sun, Aug 12, 2001 at 05:33:34PM +0200, Rudy Gevaert wrote:

> This weekend I got a strange log:
> 
> Unusual System Events
> =-=-=-=-=-=-=-=-=-=-=
> Aug 11 06:25:03 alhandra su[3584]: + ??? root-nobody
> Aug 11 06:25:03 alhandra PAM_unix[3584]: (su) session opened for user
> nobody by
> +(uid=0)

This is root (uid=0) becoming nobody.  It's surely a cron job that is setup
to change user to nobody before running.  The locate package runs updatedb
as nobody every day, for example.

-- 
Steven Barker                                      scbarker@uiuc.edu
  Woolsey-Swanson Rule:
  	People would rather live with a problem they cannot
  	solve rather than accept a solution they cannot understand.
PGP Key Fingerprint: 272A 3EC8 52CE F22B F745  775E 5292 F743 EBD5 936B
Get it at http://www.students.uiuc.edu~/scbarker/pubkey.asc