Am 19.08.2014 23:11, schrieb Joe: > Again, this seems to confirm that nobody is invoked to do a particular > job and then not logged out for some reason. This seems to be the area, > when PID 2593 appears. As all entries show the same time, I assume logs > are interleaved and this may not be the actual order of entries. The > session on PID 2592 is explicitly closed, successfully, but not 2593. As I wrote in my first email, I suspect this is a cron job which runs as the nobody user. Have you tried grep nobody /etc/cron* -R This e.g. turns up /etc/cron.daily/popularity-contest: su -s /bin/sh -c "/usr/sbin/popularity-contest" nobody here. You might check the dates of the /var/log/popularity-contest* files, if they match with the session starts you get in your journal. -- Why is it that all of the instruments seeking intelligent life in the universe are pointed away from Earth?
Attachment:
signature.asc
Description: OpenPGP digital signature