Re: 'Question about log entry'

On Thu, Mar 31, 2005 at 09:39:20PM -0600, bdk@thirdmason.com <bdk@thirdmason.com> wrote:
>
> > In checking my /var/log/auth.log I've noticed one of these a day:
> >
> > Mar 27 06:25:02 k9 su[2631]: + ??? root-nobody
> > Mar 27 06:25:02 k9 PAM_unix[2631]: (su) session opened for user nobody
> > by (uid=0)
> >
> >
> > I just noticed that they've happened all at the same time, 06:25:02. I
> > don't think a hacker is that percise, any one have an idea as to what is
> > going on?

Happening at the same time makes it sound like a cron job. Do you
maybe have a sudo job set for 6:25:02?

--
Bryan Medsker
bryan@ak.net
---------
To unsubscribe, send email to <aklug-request@aklug.org>
with 'unsubscribe' in the message body.