su login/logout spam

[P4rD0nM3]

Hey guys, lately I've been getting exactly '144' su login/logouts on every single day and I can never find the source of it.

Here's an example.

Jan 8 06:00:17 core su: pam_unix(su:session): session opened for user users1 by (uid=0)
Jan 8 06:00:26 core su: pam_unix(su:session): session closed for user user1

And it just does that all day exactly 144 times for each user account I have.

[macemoneta]

Does 'user1' run a cron job every 10 minutes (1440 minutes/day) that gets root privilege?

[P4rD0nM3]

I have some 10-min crons but none of them login as root to execute a command.

[macemoneta]

Check /var/log/secure and /var/log/cron for matching timestamps to try to identify the process.