What is nobody doing?

Kevin Miller Kevin_Miller at ci.juneau.ak.us
Fri Feb 3 17:22:22 GMT 2006

Since I upgraded one of my machines the other day (from 4.33 to 4.50.?
beta) my /var/log/messages has been filling up with the messages below.
I opened two term windows, one running 'tail -f /var/log/mail' and the
other running 'tail -f /var/log/messges' then watched to see what it was

Feb  2 08:18:23 mail3 su: (to nobody) root on none
Feb  2 08:18:23 mail3 su: pam_unix2: session started for user nobody,
service su
Feb  2 08:18:23 mail3 su: pam_unix2: session finished for user nobody,
service su

Feb  2 08:18:21 mail3 sendmail-in[6185]: k12HIK0g006185:
to=<AStubblefield at juneaupolice.com>, delay=00:00:00, mailer=esmtp,
pri=33805, stat=queued
Feb  2 08:18:22 mail3 MailScanner[5160]: New Batch: Scanning 1 messages,
4424 bytes

Normally I see a few 'session started for user nobody' when updatedb
runs, but these are happening everytime new mail arrives.  The su seems
to happen just after the message is queued, that is between the first
and second lines in the mail log.  Is this expected behavior?  Why does
root need to su to nobody to do whatever it's doing, when it never had
to before?

Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500

More information about the MailScanner mailing list