login on ttyu0 at night time??

Summer

Jul 23 00:52:02 login login on ttyu0 as root
Jul 22 00:38:19 login login on ttyu0 as root
Jul 21 00:53:45 login login on ttyu0 as root
Jul 20 00:52:32 login login on ttyu0 as root
Jul 19 01:14:23 login login on ttyu0 as root

this came from system logs, what this means?

Someone has violated my firewall?
Thanks, TB

NogBadTheBad

Jul 31 16:35:01 sshd 89811 Accepted keyboard-interactive/pam for admin from IP-ADDRESS port 60243 ssh2

Do you see anything like the above in Status -> System Logs -> System -> General

If so you'll see the IP its comming from, otherwise type in last from a ssh prompt.

stephenw10

login on ttyu0 implies directly on the local console.
Are your system log times correct? The timezone may be off.
Do you login at the local console ever?
Does your firewall reboot at that time?

Steve

Summer

system is up from 1 month, the console cable is connected to another device that shutdown at the login hour.
Is this the case?

Time is correct:

last

root       ttyu0                           Wed Aug  1 00:42   still logged in
root       ttyu0                           Tue Jul 31 00:58 - 00:42  (23:44)
root       ttyu0                           Mon Jul 30 00:51 - 00:58 (1+00:07)

jimp

ttyu0 is the serial console.

Do you have your serial console connected anywhere? Maybe if you are connected with a USB serial adapter, when you shutdown the desktop or other PC it's plugged into, it sends a serial break which may make the menu redisplay which would cause that message.