What is nobody doing?

[Kevin Miller]

Since I upgraded one of my machines the other day (from 4.33 to 4.50.?
beta) my /var/log/messages has been filling up with the messages below.
I opened two term windows, one running 'tail -f /var/log/mail' and the
other running 'tail -f /var/log/messges' then watched to see what it was
happening.  

/var/log/messages:
==================
Feb  2 08:18:23 mail3 su: (to nobody) root on none
Feb  2 08:18:23 mail3 su: pam_unix2: session started for user nobody,
service su
Feb  2 08:18:23 mail3 su: pam_unix2: session finished for user nobody,
service su

/var/log/mail:
==============
Feb  2 08:18:21 mail3 sendmail-in[6185]: k12HIK0g006185:
to=<AStubblefield at juneaupolice.com>, delay=00:00:00, mailer=esmtp,
pri=33805, stat=queued
Feb  2 08:18:22 mail3 MailScanner[5160]: New Batch: Scanning 1 messages,
4424 bytes

Normally I see a few 'session started for user nobody' when updatedb
runs, but these are happening everytime new mail arrives.  The su seems
to happen just after the message is queued, that is between the first
and second lines in the mail log.  Is this expected behavior?  Why does
root need to su to nobody to do whatever it's doing, when it never had
to before?



...Kevin
-- 
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500