:When I looked in /var/log/messages, I found this line and it looked strange.
:What does it mean? Could this be a security hazard? Thanx.
That's a good habit to check your logs...
:PAM_pwdb: (su) session opened for user nobody
:Feb 7 04:04:09 PAM_pwdb: (su) session closed for user nobody
In fact, the most reasonable possibility is that a cron job needs to be run
as user nobody, so root call the corresponding program through su.
This is the case with updatedb (for locate). You should look in your cron
table wether this is the case.