I had a strange line in /var/log/messages this week. When the user logged in, the message created was:

session opened for user xxx by operator(uid=11)

The only problem...user xxx isn't a member of operator group...and besides, syslogd records the uid, not the gid.

This machine was originally cloned from another machine using rsync. There were inconsistencies in the uid/gid's from the get go (owing to the users being set up in a different order: i.e. user 500 on the parent became user 502 on the clone, etc.).

Is there a possible innocent explaination for the "operator" uid in the logs?

//Old issues cleanup. Please disregard if solved/no longer applicable.

Is there a possible innocent explaination for the "operator" uid in the logs?
With all due respect, but don't look for explanations (innocent or not) when you KNOW your first priority should be to fix stuff.