[SunHELP] Sulog

Hello,
Yesterday around 17:00 we had a server crash.  I saw the following entries
in the sulog around that time:

SU 10/27 17:01 + console netuser-oracle
SU 10/27 17:02 + console netuser-oracle
SU 10/27 17:07 + console root-oracle
SU 10/27 17:07 + console LOGIN-oracle

The room that contains the console is highly protected and the door entry
logs show no one in or out around that time.  I am wondering if a cron job
may have caused these entries?  I do not see these entries in a regular
pattern between the sulog and the cron log...so I don't think it was a cron
job but I am not sure what that leaves me with...any ideas?


Thanks,

Shain