Re: Strange 'su' error messages

[Barak Korren <ifireball@ifireball.dyndns.org>]

Ian Brayshaw wrote:

> On Tuesday 13 January 2004 9:29 am, Christian Schuerer wrote:
>  
>
> > Since updating my debian server yesterday I get the following error
> > messages every hour (generated by logcheck):
> >
> >  Jan 13 06:25:01 asterix su[5741]: + ??? root:nobody
> >    
>
> I now get similar messages in my logs after a recent  upgrade of AIDE.
>
> .ib
>
>
>  
I got those too:

Jan 15 06:25:03 ifireball su[21163]: + ??? root:nobody


However, I do not have AIDE installed, and greping for "su" in 
/etc/cron/daily produced
nothing meaningful.
also, chkrootkit reports process hidden from ps,  but /proc/*/status 
reports them to be
ksoftirq_CPU0, kswapd, bdflush and kupdated which seems to be legit (no 
doubles)

Am I missing something here?

ifb.