This had been bugging me for some time, and I finally figured it out, so I thought I'd post the solution to this forum. A couple of months back I started getting these errors appearing in my /var/log/ispconfig/cron.log Mon Apr 4 23:00:45 UTC 2016 expr: syntax error They always started around 23:00:40, give or take five seconds. There were always 20 entries which lasted around a minute until 23:01:40 give or take ten seconds. My first instinct was to look through all the cron jobs on the system: those held in /etc/ and the individual user entries, and also anacron. Nothing started at 23:00. Hmmm. So it must be the line in crontab which runs every minute: * * * * * /usr/local/ispconfig/server/server.sh I looked through that script but didn't get any clues. Then I decided to lay a "trap". I'd write a script to go off at 23:00, and print the output of ps to a text file every ten seconds for the next two minutes. It looked a bit like this #!/bin/bash for COUNT in $(seq 14) do /bin/ps aux | /bin/grep -v "\[" | /bin/grep -v php-fpm > /root/mystery/ps-$COUNT.txt sleep 10 done When I looked at the files the next day, it seemed that rkhunter might be the problem as it was active for around two minutes at that period. I ran it manually and got a load of errors. These were because I'd upgraded Debian 7 to Debian 8, and the database of known file signatures wasn't up to date, hence it was complaining. So running 'rkhunter --propupd' updated the database, and no more errors. Case closed.
