I am using Ubuntu 12.04 as a desktop and recently had a weird crash with the log file for cups filling up the entire drive and not letting me back in, also what changed was /var/lib/sudo had changed from root to peter (me) I didn't make this change - I checked the history! I set the sudoers back to root and capped the max size for cups log Anyone had a similar experience? It feels like someone is messing around with my settings Is there any way to trace how the error occurred?

Logs auth.log

Jan  1 02:04:13 peter-desktop lightdm: pam_unix(lightdm:session): session opened for    user lightdm by (uid=0)
Jan  1 02:04:13 peter-desktop lightdm: pam_ck_connector(lightdm:session): nox11 mode, ignoring PAM_TTY :0
Jan  1 02:06:53 peter-desktop lightdm: pam_unix(lightdm:session): session opened for user lightdm by (uid=0)
Jan  1 02:06:53 peter-desktop lightdm: pam_ck_connector(lightdm:session): nox11 mode, ignoring PAM_TTY :0

syslog

Jan  1 02:04:13 peter-desktop rsyslogd: [origin software="rsyslogd" swVersion="5.8.6" x-pid="903" x-info="http://www.rsyslog.com"] start
Jan  1 02:04:13 peter-desktop rsyslogd: rsyslogd's groupid changed to 103
Jan  1 02:04:13 peter-desktop rsyslogd: rsyslogd's userid changed to 101
Jan  1 02:04:13 peter-desktop rsyslogd-2039: Could not open output pipe '/dev/xconsole'  [try http://www.rsyslog.com/e/2039 ]
Jan  1 02:04:13 peter-desktop bluetoothd[898]: Failed to init gatt_example plugin
Jan  1 02:04:13 peter-desktop kernel: [    0.000000] Initializing cgroup subsys cpuset
Jan  1 02:04:13 peter-desktop kernel: [    0.000000] Initializing cgroup subsys cpu
Jan  1 02:04:13 peter-desktop kernel: [    0.000000] Linux version 3.2.0-25-generic-pae (buildd@palmer) (gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5) ) #40-Ubuntu SMP Wed May 23 22:11:24 UTC 2012 (Ubuntu 3.2.0-25.40-generic-pae 3.2.18)
Jan  1 02:04:13 peter-desktop kernel: [    0.000000] KERNEL supported cpus:
Jan  1 02:04:13 peter-desktop kernel: [    0.000000]   Intel GenuineIntel
Jan  1 02:04:13 peter-desktop kernel: [    0.000000]   AMD AuthenticAMD
Jan  1 02:04:13 peter-desktop kernel: [    0.000000]   NSC Geode by NSC