Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.
Jun 26 15:58:52 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0)
Jun 26 15:59:02 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0)
Jun 26 15:59:37 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0)

Is that something to be worried about? Does this mean someone has shell?

share|improve this question
    
I'm experiencing this as well. You wouldn't happen to have a program called "ntfs-3g" installed, would you? I'm experimenting on my box right now to see if file accesses on my ntfs drives are causing this. Update: ntfs drive access doesn't seem to be causing this. –  Dylan Knowles Jul 4 '12 at 17:50
    
is this coming from a laptop that is having its lid closed, or a machine that is being put to sleep? I'm finding that this is happening with mine. I can't say for certain that it's the cause of all of the messages, but it's an odd coincidence. –  Dylan Knowles Jul 4 '12 at 19:41

2 Answers 2

up vote 2 down vote accepted

What that is telling you is that someone who is logged in as root has for example su'ed to the user {USER}. Whether this is a problem only you can really know.

share|improve this answer

After much detective work and experiments on my machine, I've come to the conclusion that on some machines, these messages may indicate that you shut the lid (in the case of a laptop) or put the machine to sleep. As implied above, every machine and installation is different so only you will really know for sure if this is normal. Nevertheless, I hope that my answer can help you cut down your sleuthing time when trying to find the source of these messages.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.