Odd find in authentication log

[izzyknight86]

Hey there!

Found this in my logwatch report. Checked out /var/log/secure and found these two entries I personally didn't do:

Dec 30 21:02:30 localhost usermod[30054]: add 'apache' to group 'users'
Dec 30 21:02:30 localhost usermod[30054]: add 'apache' to shadow group 'users'

Has my Amahi box been compromised? Thanks for your help!

[bigfoot65]

I would say no it has not been compromised. I am unsure why that log entry showed up, but seriously doubt someone accessed your box and did it.