On Fri May 12 2000 at 14:41, [EMAIL PROTECTED] wrote:
> I always get this message on 4:02am, on my red hat machine, I suspect
> is a program login as nobody and try to become a superuser. What should I
> do to track down, where is user came from, my own maching? or some other
> place.
>
> May 7 04:02:02 linux PAM_pwdb[2926]: (su) session opened for user nobody
> by (uid=99)
> May 7 04:02:38 linux PAM_pwdb[2926]: (su) session closed for user nobody
It is the output from a cron job. 4:02am is the default time redhat
has these things set at (eg, for doing system maintenance things
like logrotate, makewhatis, updatedb and so on).
See /etc/crontab and everything in /etc/cron.*/*
Also the man pages for crontab(1) and crontab(5) if you want to see
how this works.
Cheers
Tony
-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-
Tony Nugent <[EMAIL PROTECTED]> Systems Administrator, RHCE
GrowZone OnLine (a project of) GrowZone Development Network
POBox 475 Toowoomba Oueensland Australia 4350 Ph: 07 4637 8322
-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-=*#*=-
