On Thu, Apr 26, 2001 at 11:26:41AM -0400, B.C.J.O wrote:
> Apr 26 06:25:03 cain su[2536]: + ??? root-nobody
>
> ... and I can't figure out what the heck caused it. I haven't seen a line
> like it before. Any ideas what kind of event would have caused this line
> to be logged? all clues welcome. =)
This is caused by /etc/cron.daily/find, which contains the line:
cd / && updatedb --localuser=nobody 2>/dev/null
^^^^^^^^^^^^^^^^^^
All that means is that updatedb is being run as user nobody. Unless you
just installed findutils, or never had your machine up at 6:25 AM, then
you should definitely have records of this happening more than once.
noah
--
_______________________________________________________
| Web: http://web.morgul.net/~frodo/
| PGP Public Key: http://web.morgul.net/~frodo/mail.html
Attachment:
pgpBIp9tTp9Y3.pgp
Description: PGP signature