su 로그가 나오는데...이거 정상인건지

Sep 16 04:00:00 localhost su(pam_unix)[11913]: session opened for user root by (uid=0)
Sep 16 04:00:11 localhost su(pam_unix)[11913]: session closed for user root
Sep 16 04:10:00 localhost su(pam_unix)[12409]: session opened for user root by (uid=0)
Sep 16 04:10:01 localhost su(pam_unix)[12409]: session closed for user root
Sep 16 04:11:01 localhost su(pam_unix)[12491]: session opened for user root by (uid=0)
Sep 16 04:11:01 localhost su(pam_unix)[12491]: session closed for user root
Sep 16 04:12:00 localhost su(pam_unix)[12573]: session opened for user root by (uid=0)
Sep 16 04:12:00 localhost su(pam_unix)[12573]: session closed for user root
Sep 16 04:13:00 localhost su(pam_unix)[12659]: session opened for user root by (uid=0)

현제 로그에 저렇게 나와있는데요.

시간대를 보면 새벽 4시거든요.

새벽 4시에 저희쪽에서 접근할 사람은 없는데...

누군가가 4시경에 su를 통해 root로 로그인 할려고 하는데 맞는건가요 ?

그렇다면 일반 계정이 해킹 당했다는건지....

왜 생기는지 모르겠네요..