This is an odd one and I know that the answer will be something simple that I have over looked... I have inherited responsibility for a Linux server running an old version of Ubuntu 10.04, it has a backup scrip running every hour but I can't find out where it's running from.
In the auth logs I see an entry every hour corresponding exactly to the time the backup is fired suggesting that this is a cron job:
"pam_unix(cron:session): session opened for user root"
It is not a remote command over SSH as there is no SSH session entry preceding it.
I have run the following command to list all user's cron jobs, which produces no results for anyone:
"for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l; done"
It's not anacron either... What else is there? Any suggestions on where I might look next? I am thinking potentially there is a GUI app and the auth log entry is misleading.
Thanks in advance