![Debian Linux /var/log/auth.log 中的奇怪条目](https://linux22.com/image/671253/Debian%20Linux%20%2Fvar%2Flog%2Fauth.log%20%E4%B8%AD%E7%9A%84%E5%A5%87%E6%80%AA%E6%9D%A1%E7%9B%AE.png)
我突然在 /var/log/auth.log 文件中发现了一些奇怪的条目。它们大约每 10-20 秒出现一次。cron 中没有任何东西可以做到这一点,我不知道下一步该去哪里查找。
Nov 17 02:21:06 centaur su[7498]: + ??? root:user1
Nov 17 02:21:06 centaur su[7498]: pam_unix(su:session): session opened for user user1 by (uid=0)
Nov 17 02:21:06 centaur su[7498]: pam_unix(su:session): session closed for user user1
Nov 17 02:21:22 centaur su[7560]: Successful su for user1 by root
Nov 17 02:21:22 centaur su[7560]: + ??? root:user1
Nov 17 02:21:22 centaur su[7560]: pam_unix(su:session): session opened for user user1 by (uid=0)
Nov 17 02:21:22 centaur su[7560]: pam_unix(su:session): session closed for user user1
Nov 17 02:21:22 centaur su[7572]: Successful su for user1 by root
Nov 17 02:21:22 centaur su[7572]: + ??? root:user1
Nov 17 02:21:22 centaur su[7572]: pam_unix(su:session): session opened for user user1 by (uid=0)
Nov 17 02:21:22 centaur su[7572]: pam_unix(su:session): session closed for user user1
Nov 17 02:21:38 centaur su[7635]: Successful su for user1 by root
Nov 17 02:21:38 centaur su[7635]: + ??? root:user1
Nov 17 02:21:38 centaur su[7635]: pam_unix(su:session): session opened for user user1 by (uid=0)
Nov 17 02:21:38 centaur su[7635]: pam_unix(su:session): session closed for user user1
Nov 17 02:21:38 centaur su[7647]: Successful su for user1 by root
Nov 17 02:21:38 centaur su[7647]: + ??? root:user1
Nov 17 02:21:38 centaur su[7647]: pam_unix(su:session): session opened for user user1 by (uid=0)
Nov 17 02:21:38 centaur su[7647]: pam_unix(su:session): session closed for user user1
我能够使用以下命令从顶部获取信息,但这没什么帮助:
top -b -d 0.1 -n 11130 >> top-file
结果:
6342 root 20 0 60928 1676 1260 S 0.0 0.1 0:00.00 su
有没有办法让 lsof 做类似的事情,以便我弄清楚到底发生了什么? 或者有更好的方法可以解决这个问题?
我尝试使用以下命令来执行 lsof,但是它似乎没有按照我需要的方式工作:
lsof +r 1 >> lsof-file
谢谢