I want to find what causes cron process to load cpu at particular time on daily basis

Hello everyone!

Recently I noticed that every day at around 6:52 UTC cron process loads cpu when there are seemingly no cron jobs running at that time!

crontab file looks like this: 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

Monthly jobs have this exact time, however it seems, that this particular job runs everyday (and not on 1st day of the month for sure). Anyway there are no monthly jobs in cron.monthly.

Daily jobs on another hand have different time.

I checked crontab -l for all users and only a single user has anything there, it’s an every-minute ping of a different process. rsyslog for crons only has records for that every-minute cron job during this time.

I’m puzzled what could that cpu load mean, as I don’t see what cron job could be doing it. I’m a bit concerned in regards to security. It doesn’t seem possible that a mentioned minutely job can be producing virtually no load throughout the day and then during a single run at the same time of the day every day it would go up to 90% on a single core for a minute.

Any suggestions how I can identify the job if I connect to the server when it is running? Is it possible to run a script using a cron process without scheduling it?

Thank you in advance!