I get messages in my logs like this:

Jan 4 00:00:04 localhost /usr/bin/crontab[20339]: (root) AUTH (crontab command not allowed)

every day at midnight, 3:00 AM and 8:00 AM and I'm damned if I can find out what's generating them.

Anyone with any bright ideas?