program try to login?

[hcchin]

    I always get this message on 4:02am, on my red hat machine, I suspect 
is a program login as nobody and try to become a superuser. What should I 
do to track down, where is user came from, my own maching? or some other 
place.

May  7 04:02:02 linux PAM_pwdb[2926]: (su) session opened for user nobody 
by (uid=99)
May  7 04:02:38 linux PAM_pwdb[2926]: (su) session closed for user nobody