<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<font size="-1">Just having a trawl through the logs on my Samba server
(running on Ubuntu server 6.06), and I've noticed the following *every*
day at the exact same time:<br>
Jul 13 06:25:01 fs01 su[5018]: + ??? root:nobody<br>
Jul 13 06:25:01 fs01 su[5018]: (pam_unix) session opened for user
nobody by (uid=0)<br>
Jul 13 06:25:01 fs01 su[5018]: (pam_unix) session closed for user nobody<br>
Jul 13 06:25:01 fs01 su[5022]: + ??? root:nobody<br>
Jul 13 06:25:01 fs01 su[5022]: (pam_unix) session opened for user
nobody by (uid=0)<br>
Jul 13 06:25:01 fs01 su[5022]: (pam_unix) session closed for user nobody<br>
Jul 13 06:25:01 fs01 su[5024]: + ??? root:nobody<br>
Jul 13 06:25:01 fs01 su[5024]: (pam_unix) session opened for user
nobody by (uid=0)<br>
Jul 13 06:25:01 fs01 su[5024]: (pam_unix) session closed for user nobody<br>
<br>
I can't seem to work out what is causing it.. and it's odd that it
occurs at the same time every day. All the other 'root' entries, have
"CRON" rather than "su"..<br>
<br>
Any thoughts would be appreciated!<br>
</font>
<div class="moz-signature">-- <br>
<meta http-equiv="Content-Type" content="text/html; ">
<div> <font face="Arial" size="2"><strong>Daniel Pearson<br>
</strong><font size="1">Flashware Solutions ABN 58 438 456 919</font></font></div>
<div> <font face="Arial"><font size="1">Mob: 0438 118 897 | Email: </font>
<a href="mailto:daniel@flashware.net"><font size="1">daniel@flashware.net</font></a></font></div>
<div> <font face="Arial" size="1"><br>
The information contained in this electronic transmission is
confidential. If you are not the intended recipient of this
transmission, use of this information is strictly prohibited. If you
have received this transmission in error, please contact Flashware
Solutions 0438 118 897.</font></div>
</div>
</body>
</html>