Jan 30 06:17:01 localhost CRON[13941]: (pam_unix) session closed for user root
Jan 30 06:25:01 localhost CRON[13946]: (pam_unix) session opened for user root by (uid=0)
Jan 30 06:26:15 localhost su[13980]: + ??? root:nobody
Jan 30 06:26:15 localhost su[13980]: (pam_unix) session opened for user nobody by (uid=0)
Jan 30 06:26:23 localhost CRON[13946]: (pam_unix) session closed for user root
Jan 30 06:39:01 localhost CRON[14062]: (pam_unix) session opened for user root by (uid=0)


Afther 06.26, my server gives error about accessiong a on hda, i think that it can be the "su" access, how can i know what's the script that run that "su"?