Ahi, ho trovato queste stringhe:

Sep 12 06:25:02 debian su[16805]: + ??? root:nobody
Sep 12 06:25:02 debian su[16805]: (pam_unix) session opened for user nobody by (uid=0)
Sep 12 06:25:02 debian su[16806]: + ??? root:nobody
Sep 12 06:25:02 debian su[16806]: (pam_unix) session opened for user nobody by (uid=0)
Sep 12 06:25:02 debian su[16807]: + ??? root:nobody
Sep 12 06:25:02 debian su[16807]: (pam_unix) session opened for user nobody by (uid=0)

Mi devo preoccupare?