Заметил вот такую активность в /var/log/auth.log
Mar  7 15:17:01 user-system CRON[3544]: pam_unix(cron:session): session opened for user root by (uid=0)
Mar  7 15:17:01 user-system CRON[3544]: pam_unix(cron:session): session closed for user root
crontab -l


