Strange auth.log entry

[bxf4@psu.edu (Brian P. Flaherty)]

Hello,

I found this in my auth.log yesterday and I am puzzeled by it.

Nov  7 00:52:56 localhost PAM_unix[4704]: authentication failure; (uid=0) -> **unknown** for passwd service

I don't know how to interpret the (uid=0) -> **unknown** part.  I
don't think I was working as root at the time (in fact, I don't think
I was working at all at the time).  I know sometimes a root process
switches over to nobody (for example, wwwoffle).  I searched through
all my past auth.log* files and did not find any other examples of
this, so I don't think it is a (daily) cron job.  Finally, I don't see
any record of someone trying to access the machine in kern.log or the
ippl log.

Also, how do I find out what PAM_unix[4704] refers to?  I assume 4704
is some sort of message, but I don't know where to look.  I perused
the libpam-doc in /usr/doc, but did not see any sections that looked
like a code reference.

Thanks for any thoughts or suggestions.

Brian Flaherty