Topic: an opinion on log events??

[joephp]

Hi All,
does anyone have an opinion or thought on these entries in my "secure" log file. I can't seem to pin point an event with the action.
Jul  8 11:28:09 zenon333 usermod[3505]: change user admin' shell from /sbin/e-smith/console' to /sbin/e-smith/console'
Jul  8 11:28:09 zenon333 usermod[3510]: change user www' shell from /bin/false' to /bin/false'
Jul  8 11:41:13 zenon333 usermod[2139]: change user admin' shell from /sbin/e-smith/console' to /sbin/e-smith/console'
Jul  8 11:41:13 zenon333 usermod[2144]: change user www' shell from /bin/false' to /bin/false'
I use SME 6 Final Dev and I was having some problems with a specific IP address during this time frame. However I couldn't see a connection with this event and the buffer underrun attempts.
Any input appreciated!
Thanks
Joe