We have a news server running on a CentOS 6.5 box. It's leafnode, and a cron is set to run every two minutes. We decide to shut it down to troubleshoot other issues, so we comment out the line in the crontab:
# */2 * * * * /usr/sbin/fetchnews
For some reason, however, we're still getting news articles updated. So we decide to change the permissions of that binary.
chmod 400 /usr/sbin/fetchnews
Then, we start to get e-mails every two minutes: '/usr/sbin/fetchnews: permission denied'.
We look in /etc/cron/hourly, in fact in everything to do with crond in /etc. It's not in root's crontab file, it's not in the news user's crontab file, and it's not in any other user's crontab file.
How can I find out what is causing this binary to be run?