[plug] auth.log

[Daniel Pearson (Flashware Solutions)]

Just having a trawl through the logs on my Samba server (running on 
Ubuntu server 6.06), and I've noticed the following *every* day at the 
exact same time:
Jul 13 06:25:01 fs01 su[5018]: + ??? root:nobody
Jul 13 06:25:01 fs01 su[5018]: (pam_unix) session opened for user nobody 
by (uid=0)
Jul 13 06:25:01 fs01 su[5018]: (pam_unix) session closed for user nobody
Jul 13 06:25:01 fs01 su[5022]: + ??? root:nobody
Jul 13 06:25:01 fs01 su[5022]: (pam_unix) session opened for user nobody 
by (uid=0)
Jul 13 06:25:01 fs01 su[5022]: (pam_unix) session closed for user nobody
Jul 13 06:25:01 fs01 su[5024]: + ??? root:nobody
Jul 13 06:25:01 fs01 su[5024]: (pam_unix) session opened for user nobody 
by (uid=0)
Jul 13 06:25:01 fs01 su[5024]: (pam_unix) session closed for user nobody

I can't seem to work out what is causing it.. and it's odd that it 
occurs at the same time every day. All the other 'root' entries, have 
"CRON" rather than "su"..

Any thoughts would be appreciated!
-- 
*Daniel Pearson
*Flashware Solutions ABN 58 438 456 919
Mob: 0438 118 897  |  Email: daniel at flashware.net 
<mailto:daniel at flashware.net>

The information contained in this electronic transmission is 
confidential. If you are not the intended recipient of this 
transmission, use of this information is strictly prohibited.  If you 
have received this transmission in error, please contact Flashware 
Solutions 0438 118 897.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.plug.org.au/pipermail/plug/attachments/20060716/7a34252f/attachment.html>