/usr/bin/updatedb; Re: [plug] auth.log

Alastair Irvine alastair at ucc.gu.uwa.edu.au
Mon Jul 17 18:47:41 WST 2006


On Mon, 17 Jul 2006 11:33 am, Timothy White wrote:
> > > And here's everything that's in the Crontab atm..
> > > 17 *    * * *   root    run-parts --report /etc/cron.hourly
> > > 25 6    * * *   root    test -x /usr/sbin/anacron ||
> > > run-parts --report
> >
> > Am I right in suggesting that the line above is set to activate
> > at the same time that you are having the log entries for the
> > 'nobody' sessions ?
>
> Check the /etc/anacrontab and see what is running. You'll
> probably find that it's something in the /etc/cron.d or
> /etc/cron.daily directorys. (They are like 'crontab' parts,
> making up a large crontab, so not everything run by cron is in
> /etc/crontab, lots is in separate files, for easier management by
> packages).

As you can see from the above crontab lines, even if anacron is not 
installed, the files in /etc/cron.daily are still run.  As they are 
on my debian box.

I found out that /etc/cron.daily/find runs the /usr/bin/updatedb 
script*.  The former exports LOCALUSER="nobody", which tells the 
latter which user to "su" as.  This looks like the source of your 
log entries.

* this rebuilds a pathname database for use by the "locate" utility.

PS -- The "nobody" user is important for many programs (like Apache) 
that require it to exist so that they can run in "low priviledge" 
mode.  Don't remove it.



More information about the plug mailing list