Hello, I found this in my auth.log yesterday and I am puzzeled by it.
Nov 7 00:52:56 localhost PAM_unix[4704]: authentication failure; (uid=0) -> **unknown** for passwd service I don't know how to interpret the (uid=0) -> **unknown** part. I don't think I was working as root at the time (in fact, I don't think I was working at all at the time). I know sometimes a root process switches over to nobody (for example, wwwoffle). I searched through all my past auth.log* files and did not find any other examples of this, so I don't think it is a (daily) cron job. Finally, I don't see any record of someone trying to access the machine in kern.log or the ippl log. Also, how do I find out what PAM_unix[4704] refers to? I assume 4704 is some sort of message, but I don't know where to look. I perused the libpam-doc in /usr/doc, but did not see any sections that looked like a code reference. Thanks for any thoughts or suggestions. Brian Flaherty
