What is nobody doing?
Kevin_Miller at ci.juneau.ak.us
Fri Feb 3 17:22:22 GMT 2006
Since I upgraded one of my machines the other day (from 4.33 to 4.50.?
beta) my /var/log/messages has been filling up with the messages below.
I opened two term windows, one running 'tail -f /var/log/mail' and the
other running 'tail -f /var/log/messges' then watched to see what it was
Feb 2 08:18:23 mail3 su: (to nobody) root on none
Feb 2 08:18:23 mail3 su: pam_unix2: session started for user nobody,
Feb 2 08:18:23 mail3 su: pam_unix2: session finished for user nobody,
Feb 2 08:18:21 mail3 sendmail-in: k12HIK0g006185:
to=<AStubblefield at juneaupolice.com>, delay=00:00:00, mailer=esmtp,
Feb 2 08:18:22 mail3 MailScanner: New Batch: Scanning 1 messages,
Normally I see a few 'session started for user nobody' when updatedb
runs, but these are happening everytime new mail arrives. The su seems
to happen just after the message is queued, that is between the first
and second lines in the mail log. Is this expected behavior? Why does
root need to su to nobody to do whatever it's doing, when it never had
Kevin Miller Registered Linux User No: 307357
CBJ MIS Dept. Network Systems Admin., Mail Admin.
155 South Seward Street ph: (907) 586-0242
Juneau, Alaska 99801 fax: (907 586-4500
More information about the MailScanner