(1) The white text on black background blinks continue; when they occur, it's
just before the Plymouth screen.
(2) Even though I've removed apache2, I'm still seeing user www-data
activity:
> user@user-ThinkPad-T420:~$ grep "Sep 14" /var/log/auth.log
... snippage ...
> Sep 14 07:29:28 user-ThinkPad-T420 su[2950]: Successful su for www-data by
root
> Sep 14 07:29:28 user-ThinkPad-T420 su[2950]: + ??? root:www-data
> Sep 14 07:29:28 user-ThinkPad-T420 su[2950]: pam_unix(su:session): session
opened for user www-data by (uid=0)
> Sep 14 07:29:28 user-ThinkPad-T420 systemd-logind[989]: Removed session c1.
> Sep 14 07:29:28 user-ThinkPad-T420 systemd-logind[989]: New session c3 of
user www-data.
> Sep 14 07:29:28 user-ThinkPad-T420 su[2950]: pam_unix(su:session): session
closed for user www-data
> Sep 14 07:29:34 user-ThinkPad-T420 systemd-logind[989]: Removed session c3.
Which program needs user www-data ? I checked /var/www/dwww and /var/www/html
and there's only generic boilerplate there.
The pam_unix sessions were too short to accomplish anything ...
