> > Tuc at T-B-O-H.NET wrote: > > >>>Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN > >>> > >>> > Something running *as* root is trying to "su" to an account which has > /bin/nologin as a shell > > e.g. # su avahi > > cartman nologin: Attempted login by alex on /dev/ttyp7 > > avahi:*:558:558:Avahi Daemon User:/nonexistent:/sbin/nologin > Thats what I was thinking... > > If it were running detached from a terminal (in the background; started > from an rc script) then it would have no terminal to report, hence UNKNOWN. > Makes sense. :) > > Tracking down what, is another matter. ps uagx and kill processes one > by one until the message stops! Or try ktracing suspects for a less > drastic approach. > I'm pretty sure it has to do with my sendmail. Why all of a sudden its done this I'm not sure. I shut down sendmail for an hour and the messages stopped. When I started it back up, it started again. I'm running :
sendmail / procmail / SpamAssassin If I was to ktrace sendmail, what would I be looking for? What options do I pass to it to get all the sub processes? Thanks, Tuc _______________________________________________ email@example.com mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"