auth.log

Nov  7 07:35:26 server su[17668]: Successful su for nobody by root
Nov  7 07:35:26 server su[17668]: + ??? root:nobody
Nov  7 07:35:26 server su[17668]: pam_unix(su:session): session opened for user nobody by (uid=0)
Nov  7 07:35:27 server systemd: pam_unix(systemd-user:session): session opened for user nobody by (uid=0)
Nov  7 07:35:27 server systemd-logind[510]: New session c40 of user nobody.
Nov  7 07:35:27 server su[17668]: pam_unix(su:session): session closed for user nobody
Nov  7 07:35:28 server systemd-logind[510]: Removed session c40.
Nov  7 07:35:28 server su[17707]: Successful su for nobody by root
Nov  7 07:35:28 server su[17707]: + ??? root:nobody
Nov  7 07:35:28 server systemd: pam_unix(systemd-user:session): session closed for user nobody
Nov  7 07:35:28 server su[17707]: pam_unix(su:session): session opened for user nobody by (uid=0)
Nov  7 07:35:28 server systemd: pam_unix(systemd-user:session): session opened for user nobody by (uid=0)
Nov  7 07:35:28 server systemd-logind[510]: New session c41 of user nobody.
Nov  7 07:35:28 server su[17707]: pam_unix(su:session): session closed for user nobody
Nov  7 07:35:28 server systemd-logind[510]: Removed session c41.
Nov  7 07:35:28 server su[17739]: Successful su for nobody by root
Nov  7 07:35:28 server su[17739]: + ??? root:nobody
Nov  7 07:35:28 server su[17739]: pam_unix(su:session): session opened for user nobody by (uid=0)
Nov  7 07:35:28 server systemd-logind[510]: New session c42 of user nobody.
Nov  7 07:35:28 server systemd: pam_unix(systemd-user:session): session opened for user nobody by (uid=0)
Nov  7 07:35:57 server CRON[17011]: pam_unix(cron:session): session closed for user munin
Nov  7 07:36:01 server CRON[17970]: pam_unix(cron:session): session opened for user user2 by (uid=0)
Nov  7 07:36:03 server CRON[17970]: pam_unix(cron:session): session closed for user user2
Nov  7 07:36:33 server su[17739]: pam_unix(su:session): session closed for user nobody
Nov  7 07:36:33 server systemd-logind[510]: Removed session c42.
Nov  7 07:37:01 server CRON[18097]: pam_unix(cron:session): session opened for user user2 by (uid=0)