Заметил вот такую активность в /var/log/auth.log
Mar 7 15:17:01 user-system CRON[3544]: pam_unix(cron:session): session opened for user root by (uid=0)
Mar 7 15:17:01 user-system CRON[3544]: pam_unix(cron:session): session closed for user root
crontab -l