[NBLUG/talk] cron entries

[Sean]

I've got two systems running cron jobs every minute. They are nearly
identical systems, so I suspect that some software that I put on them
both (possibly webmin, but a third only gets it every 5 minutes for
clearing cache) causes this.

Every minute I get an entry in auth.log from CRON stating that
(pam_unix) session opened for root, and then closes the session before
that second is up. For the life of me I can't find where cron is
getting triggered.

I've look in /etc/cron.d, /var/spool/cron/crontab, check all user's
crontabs, and even checked remote servers for rsync traffic. I found a
few things, but after erasing them all the entries continue to show
up.

Does anyone have any ideas as to where else to look? I didn't find any
solid clues in /var/log/messages, which includes my firewall logs.
There seems to be no external traffic regularly and exactly
corresponding with the times of these entries, nor unusual or
unexpected traffic on one of these servers at or around these times.
I'm quite sure my systems are not compromised, but I'd like to find
out what's causing this.

Thanks!

Sean