I just had a question regarding the attached part of my /var/log/auth.log file. (Raspberry Pi 2B, running Raspbian Jessy, fully updated / upgraded)First of all I got rid of the root user all together, but i seem to see a bunch of log-ins for that user (displaying root and/or uid=0), which seem to be locally, as there is no IP-address. -> Can someone explain that to me please?The second question is, why is there an entry for a session of user smmsp every couple minutes, kinda freaks me out.If someone could please take a look and advise.
suspicious entries in /var/log/auth.log
cron;configuration;raspbian
The first two and the last one are CRONs, which is needed for some automated tasks (depend on what is running on your machine sudo crontab -e?The third is probably you running the tail -f /var/log/auth.log through sudo.There is nothing to be concerned about. You can't get rid of root user, otherwise you would not be able to do any administrative tasks.