working on my box this morning I noticed some drive activity that didn't seem to be connected to what I was doing.
I did a top and saw find running as user nobody. It carried on for a few more seconds and then the system was quiet. My box is a recent sarge, I run apache in standard configuration (ie it run processes as www-data) for dev purposes, noone should be connecting from outside for any reason. In the access logs I saw that root had initiated user "nobody". No other activity that looked suspect. Should I be paranoid? or is there some normal explanation for this?
