Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was just going through auth.log file, I found the following error. Can anybody tell is it a hack or just log of Bugzilla which I installed & throughing an error.

Mar 12 06:50:10 bigbugz02 su[13762]: Successful su for www-data by root
Mar 12 06:50:10 bigbugz02 su[13762]: + ??? root:www-data
Mar 12 06:50:10 bigbugz02 su[13762]: pam_unix(su:session): session opened for user www-data by (uid=0)
Mar 12 06:50:12 bigbugz02 su[13762]: pam_unix(su:session): session closed for user www-data
share|improve this question
up vote 1 down vote accepted

This is a frequently asked question in Secure Debian guide. Here is some more info on the topic:

See point 11.2.3 here

Generally it could be a cron job. So - it is safe.

share|improve this answer
Thanks a lot buddy :) I was tensed. – Caterpillar Mar 12 '12 at 11:48
Yeah...the logs can be frightening :) – TheMouse Mar 12 '12 at 12:14

This is generally a safe thing. When the application is started by root user it does this to start it as www-data user.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.