Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have following entries in /var/log/auth.log

Jan 24 06:37:54 server1 su[9508]: Successful su for nobody by root
Jan 24 06:37:54 server1 su[9508]: + ??? root:nobody

does it point to some problem I am not sure.So let me know if it is some thing I need to worry about.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

This must be a cron job, because:

  • User root dropped privileges and became "nobody" to run a cronjob. Check with crontab -l while being root. If there's no cronjob, you might want to worry.
  • Log entries (although they might be faked of course) around 06:25 AM tend to be cronjobs, updatedb commands etc.
share|improve this answer
    
Ok crontab -l gives only 8 9 * * * /etc/webmin/cron/tempdelete.pl #Delete Webmin temporary files –  Bond Jan 25 '11 at 3:47
    
Look in /etc/cron.d, /etc/cron.daily etc. too. Forgot to mention this. –  weeheavy Jan 25 '11 at 8:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.