nologin: Attempted login by root on UNKNOWN

[Tuc at T-B-O-H.NET]

> > Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
> > Jul 18 14:08:47 asgard kernel: Jul 18 14:08:47 asgard nologin: Attempted login by root on UNKNOWN
> > Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
> > Jul 18 14:21:02 asgard kernel: Jul 18 14:21:02 asgard nologin: Attempted login by root on UNKNOWN
> >
> > 	 I'm not sure who/what/where to start looking.  Ideas?
> 
> What does /var/log/auth.log show?
> 
	Nothing since I send everything to a single file and
a syslog server.

*.debug                                         /var/log/spool
*.debug                                         @syslog.t-b-o-h.net
*.err;kern.debug;auth.notice;mail.crit          /dev/console
*.emerg                                         *


		Tuc/TBOH