2 
Jun 26 15:58:52 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0)
Jun 26 15:59:02 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0)
Jun 26 15:59:37 hostme su: pam_unix(su:session): session opened for user {USER} by root(uid=0)

Is that something to be worried about? Does this mean someone has shell?

Improve this question
2
  • I'm experiencing this as well. You wouldn't happen to have a program called "ntfs-3g" installed, would you? I'm experimenting on my box right now to see if file accesses on my ntfs drives are causing this. Update: ntfs drive access doesn't seem to be causing this.
    – Dylan Knowles
    Jul 4, 2012 at 17:50
  • is this coming from a laptop that is having its lid closed, or a machine that is being put to sleep? I'm finding that this is happening with mine. I can't say for certain that it's the cause of all of the messages, but it's an odd coincidence.
    – Dylan Knowles
    Jul 4, 2012 at 19:41

2 Answers 2

Reset to default
3

What that is telling you is that someone who is logged in as root has for example su'ed to the user {USER}. Whether this is a problem only you can really know.

Improve this answer
0

After much detective work and experiments on my machine, I've come to the conclusion that on some machines, these messages may indicate that you shut the lid (in the case of a laptop) or put the machine to sleep. As implied above, every machine and installation is different so only you will really know for sure if this is normal. Nevertheless, I hope that my answer can help you cut down your sleuthing time when trying to find the source of these messages.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .