ConfigServer Community Forum

Here's a clue though -- when this happens, there are an equivalent number of stale entries written to /var/log/secure. This morning at 7 a.m., a bunch of lines dated Aug. 31 through Nov. 3 were written to that log, and sure enough, the number of su logins in that bunch of lines exactly matched the n...

I'm seeing the same thing -- more than 100 false "SU login alert" notices at 7 a.m. today. No apparent cause this time, although in the past it's happened when I do a graceful reboot. It must have something to do with a recent upgrade because I never saw it until a month or two ago.