it's not intruding.
see /etc/cron.daily/updatedb.cron
On Fri, 12 May 2000 [EMAIL PROTECTED] wrote:
> Date: Fri, 12 May 2000 14:41:46 +0800 (SGT)
> From: [EMAIL PROTECTED]
> To: [EMAIL PROTECTED]
> Subject: program try to login?
>
>
> I always get this message on 4:02am, on my red hat machine, I suspect
> is a program login as nobody and try to become a superuser. What should I
> do to track down, where is user came from, my own maching? or some other
> place.
>
> May 7 04:02:02 linux PAM_pwdb[2926]: (su) session opened for user nobody
> by (uid=99)
> May 7 04:02:38 linux PAM_pwdb[2926]: (su) session closed for user nobody
>
