How to find who pulls the script?

Question

linux

I accidentally noticed that in the home folder there is a test file, which already weighs a lot. Removed.

It still appears every 2-3 minutes, and a string with the date and part of the script that I once wrote for work were written to it.

/etc/crontab is empty. I can't figure out where the crontab is twitching from.

syslog:

Aug 27 19:40:01 home CRON[10052]: (atsivilev) CMD (echo "`date`: check inet">> /home/atsivilev/test)
Aug 27 19:42:01 home CRON[10076]: (atsivilev) CMD (echo "`date`: restart pppoe">> /home/atsivilev/test)
Aug 27 19:45:01 home CRON[10195]: (atsivilev) CMD (echo "`date`: check inet">> /home/atsivilev/test)
Aug 27 19:47:01 home CRON[10261]: (atsivilev) CMD (echo "`date`: restart pppoe">> /home/atsivilev/test)
Aug 27 19:50:01 home CRON[10390]: (atsivilev) CMD (echo "`date`: check inet">> /home/atsivilev/test)
Aug 27 19:52:01 home CRON[10414]: (atsivilev) CMD (echo "`date`: restart pppoe">> /home/atsivilev/test)
Aug 27 19:55:01 home CRON[10457]: (atsivilev) CMD (echo "`date`: check inet">> /home/atsivilev/test)
Aug 27 19:57:01 home CRON[10483]: (atsivilev) CMD (echo "`date`: restart pppoe">> /home/atsivilev/test)
Aug 27 20:00:01 home CRON[10608]: (atsivilev) CMD (echo "`date`: check inet">> /home/atsivilev/test)
Aug 27 20:02:02 home CRON[10705]: (atsivilev) CMD (echo "`date`: restart pppoe">> /home/atsivilev/test)
Aug 27 20:05:01 home CRON[10817]: (atsivilev) CMD (echo "`date`: check inet">> /home/atsivilev/test)
Aug 27 20:07:01 home CRON[10927]: (atsivilev) CMD (echo "`date`: restart pppoe">> /home/atsivilev/test)
Aug 27 20:10:01 home CRON[11083]: (atsivilev) CMD (echo "`date`: check inet">> /home/atsivilev/test)
Aug 27 20:12:01 home CRON[11206]: (atsivilev) CMD (echo "`date`: restart pppoe">> /home/atsivilev/test)
Aug 27 20:15:01 home CRON[11393]: (atsivilev) CMD (echo "`date`: check inet">> /home/atsivilev/test)

In all files like /etc/crontab or /etc/cron.d/* etc. - empty. gives out emptiness, like and Already broke his whole head, I don’t understand what script does it. And all this canoe has been written to my home folder in a file since February. Is there any way to track who is doing this and where the task comes from? It is possible that ssh -x is being executed from my work computer to my home computer (but where does the cron mark in the syslog come from then?) I usually store my scripts in /usr/local/bin but there is one garbage. Help!)

sudo grep -r -i "restart pppoe" /etc/
sudo grep -r -i "restart pppoe" /usr/
sudo grep -r -i "restart pppoe" ~/

Answer 1

user crons are located in /var/spool/cron/crontabs