On Thu, Apr 26, 2001 at 11:26:41AM -0400, B.C.J.O wrote: > Apr 26 06:25:03 cain su[2536]: + ??? root-nobody > > ... and I can't figure out what the heck caused it. I haven't seen a line > like it before. Any ideas what kind of event would have caused this line > to be logged? all clues welcome. =)
This is caused by /etc/cron.daily/find, which contains the line:
cd / && updatedb --localuser=nobody 2>/dev/null
^^^^^^^^^^^^^^^^^^
All that means is that updatedb is being run as user nobody. Unless you
just installed findutils, or never had your machine up at 6:25 AM, then
you should definitely have records of this happening more than once.
noah
--
_______________________________________________________
| Web: http://web.morgul.net/~frodo/
| PGP Public Key: http://web.morgul.net/~frodo/mail.html
pgpnU2Zu9gyxg.pgp
Description: PGP signature
