Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have following entries in /var/log/auth.log

Jan 24 06:37:54 server1 su[9508]: Successful su for nobody by root
Jan 24 06:37:54 server1 su[9508]: + ??? root:nobody

does it point to some problem I am not sure.So let me know if it is some thing I need to worry about.

share|improve this question
up vote 1 down vote accepted

This must be a cron job, because:

  • User root dropped privileges and became "nobody" to run a cronjob. Check with crontab -l while being root. If there's no cronjob, you might want to worry.
  • Log entries (although they might be faked of course) around 06:25 AM tend to be cronjobs, updatedb commands etc.
share|improve this answer
Ok crontab -l gives only 8 9 * * * /etc/webmin/cron/ #Delete Webmin temporary files – Bond Jan 25 '11 at 3:47
Look in /etc/cron.d, /etc/cron.daily etc. too. Forgot to mention this. – weeheavy Jan 25 '11 at 8:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.