On Sun, Aug 12, 2001 at 05:33:34PM +0200, Rudy Gevaert wrote: > This weekend I got a strange log: > > Unusual System Events > =-=-=-=-=-=-=-=-=-=-= > Aug 11 06:25:03 alhandra su[3584]: + ??? root-nobody > Aug 11 06:25:03 alhandra PAM_unix[3584]: (su) session opened for user > nobody by > +(uid=0)
This is root (uid=0) becoming nobody. It's surely a cron job that is setup to change user to nobody before running. The locate package runs updatedb as nobody every day, for example. -- Steven Barker [EMAIL PROTECTED] Woolsey-Swanson Rule: People would rather live with a problem they cannot solve rather than accept a solution they cannot understand. PGP Key Fingerprint: 272A 3EC8 52CE F22B F745 775E 5292 F743 EBD5 936B Get it at http://www.students.uiuc.edu~/scbarker/pubkey.asc