Ich vermute, es wird das systemd-journal ausgelesen.
Meins schaut dann z. B. für heute so aus:
echad@chet:~ $ journalctl -u iobroker --since=today Jan 12 15:08:21 chet bash[889]: Send diag info: {"uuid":"GELÖSCHT","language":"de","country":"Germany","hosts":[{"version":"7.0.6","platform":"Javascript/Node.js","type":"linux"}],"node":"v20.18.1","arch":"a> Jan 12 15:08:23 chet sudo[57479]: iobroker : PWD=/ ; USER=root ; COMMAND=/usr/bin/apt -v Jan 12 15:08:23 chet sudo[57479]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 12 15:08:23 chet sudo[57479]: pam_unix(sudo:session): session closed for user root Jan 12 15:08:23 chet sudo[57484]: iobroker : PWD=/ ; USER=root ; COMMAND=/usr/bin/apt list --upgradeable Jan 12 15:08:23 chet sudo[57484]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 12 15:08:24 chet sudo[57484]: pam_unix(sudo:session): session closed for user root Jan 12 15:28:32 chet bash[889]: Send diag info: {"uuid":"GELÖSCHT","language":"de","country":"Germany","hosts":[{"version":"7.0.6","platform":"Javascript/Node.js","type":"linux"}],"node":"v20.18.1","arch":"a> Jan 12 15:28:34 chet sudo[58314]: iobroker : PWD=/ ; USER=root ; COMMAND=/usr/bin/apt -v Jan 12 15:28:34 chet sudo[58314]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 12 15:28:34 chet sudo[58314]: pam_unix(sudo:session): session closed for user root Jan 12 15:28:35 chet sudo[58331]: iobroker : PWD=/ ; USER=root ; COMMAND=/usr/bin/apt list --upgradeable Jan 12 15:28:35 chet sudo[58331]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 12 15:28:36 chet sudo[58331]: pam_unix(sudo:session): session closed for user root Jan 12 16:48:03 chet bash[889]: Send diag info: {"uuid":"GELÖSCHT","language":"de","country":"Germany","hosts":[{"version":"7.0.6","platform":"Javascript/Node.js","type":"linux"}],"node":"v20.18.1","arch":"a> Jan 12 16:48:05 chet sudo[62196]: iobroker : PWD=/ ; USER=root ; COMMAND=/usr/bin/apt -v Jan 12 16:48:05 chet sudo[62196]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 12 16:48:05 chet sudo[62196]: pam_unix(sudo:session): session closed for user root Jan 12 16:48:05 chet sudo[62201]: iobroker : PWD=/ ; USER=root ; COMMAND=/usr/bin/apt list --upgradeable Jan 12 16:48:05 chet sudo[62201]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 12 16:48:06 chet sudo[62201]: pam_unix(sudo:session): session closed for user root Jan 12 16:48:19 chet bash[889]: ================================== > LOG REDIRECT system.adapter.admin.0 => false [Process stopped] Jan 12 16:48:19 chet bash[889]: ================================== > LOG REDIRECT system.adapter.admin.0 => false [system.adapter.admin.0.logging] Jan 12 16:48:58 chet su[62281]: pam_unix(su:auth): authentication failure; logname= uid=1001 euid=0 tty= ruser=iobroker rhost= user=root Jan 12 16:48:59 chet su[62281]: FAILED SU (to root) iobroker on none Jan 12 16:49:01 chet su[62284]: pam_unix(su:auth): authentication failure; logname= uid=1001 euid=0 tty= ruser=iobroker rhost= user=root Jan 12 16:49:03 chet bash[889]: Send diag info: {"uuid":"GELÖSCHT","language":"de","country":"Germany","hosts":[{"version":"7.0.6","platform":"Javascript/Node.js","type":"linux"}],"node":"v20.18.1","arch":"a> Jan 12 16:49:03 chet su[62284]: FAILED SU (to root) iobroker on none Jan 12 16:49:05 chet sudo[62296]: iobroker : PWD=/ ; USER=root ; COMMAND=/usr/bin/apt -v Jan 12 16:49:05 chet sudo[62296]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 12 16:49:05 chet sudo[62296]: pam_unix(sudo:session): session closed for user root Jan 12 16:49:05 chet sudo[62301]: iobroker : PWD=/ ; USER=root ; COMMAND=/usr/bin/apt list --upgradeable Jan 12 16:49:05 chet sudo[62301]: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1001) Jan 12 16:49:06 chet sudo[62301]: pam_unix(sudo:session): session closed for user root Jan 12 16:49:12 chet bash[889]: ================================== > LOG REDIRECT system.adapter.admin.0 => true [system.adapter.admin.0.logging]Die Meldung FAILED SU (to root) iobroker on none ist total irrelevant.