I found this in /run/log/journal/...

MESSAGE=anthony : TTY=pts/10 ; PWD=/ ; USER=root ; COMMAND=/usr/bin/find / -name *systemctI*

I'm wondering what this means? I'm suspicious of this process "systemctI" since it's one letter off from systemctl. And I was doing some digging and found the above in a log file.

What does it mean? I have a feeling it means the process is using the root user but is pretending to use "anthony." Is this correct?

  • The real systemctl ends with an L, but the one in my logs ends with an capital i. – Tony Friz Feb 14 '19 at 19:37

The syntax matches log messages generated by sudo, but if you are viewing it from systemd's journal files, then it might not have the normal syslog-style <timestamp> <hostname> <program name>: prefix.

The journal files are in a binary format, so they're best viewed using the journalctl command or some other systemd-specific viewer. If you just look for text among the binary data, you'll miss the timestamps and other important metadata.

Assuming this is in fact generated by sudo, it would mean that user anthony had a session running on a pseudo-TTY pts/10 (= might be a terminal window in a local GUI session, or e.g. a remote SSH session), cd'd to the root directory, and ran a command sudo find / -name *systemctI*.

last anthony | grep pts/10 might give you more information on whether the session was a local terminal window or a remote session, and when the session might have happened. If the 3rd field of the last output says :0, then that is a local X11 GUI session; otherwise it should have the source IP address of the remote session.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.