In my access.log I see requests coming from 127.0.0.1 and retrieving server's "/" and then all of graphics and CSS referenced in it. This happens regularly, every 5 minutes.
I want to find out what, why and how runs wget like this.
I changed "referer" in
/etc/wgetrc to verify it's local wget executable making these calls, it is.
Couldn't find anything suspicious in crontab.
The server is running munin-node. Could a munin plugin be doing this?