Sorry if this is obvious. I just switched from Gentoo on my linode to Ubuntu. I only have ssh and apache2 running with open ports. I don't have any cron jobs scheduled

# crontab -l
no crontab for ...

But, I get this in my /var/log/messages

:
Dec 23 05:06:56 www -- MARK --
Dec 23 05:26:56 www -- MARK --
Dec 23 05:46:56 www -- MARK --
Dec 23 06:06:56 www -- MARK --
Dec 23 06:27:13 www exiting on signal 15
Dec 23 06:27:16 www syslogd 1.4.1#17ubuntu7: restart.
Dec 23 06:47:15 www -- MARK --
Dec 23 07:07:15 www -- MARK --
Dec 23 07:27:15 www -- MARK --
Dec 23 07:47:16 www -- MARK --
:

May be it's an apache2 thing? Seems to happen every 20 mins, and then there's this sorta restart. There are 100's of lines of this sort in my messages log. Sorry if this is obvious, but I'm a bit stuck.

# man syslogd

Duh, thanks. Just switched distro's and still getting used to the new one. I certainly didn't think that was coming from syslog. thanks.

It's probably worth noting at this point that /var/log/messages is probably not the file you're looking for; Ubuntu is based on Debian, which doesn't log all messages to that file by default. Instead, you'll want to look in a few different files. I'm not sure how it is in Ubuntu, but on my Debian Linode, the files you want are:

/var/log/auth.log - stores messages about authentication, including opening of sessions, etc.
/var/log/daemon.log - Log file for daemons that use it; most often daemons will also log to another file too. Some (like Apache) don't seem to use it at all.
/var/log/kern.log - Kernel messages (including boot messages).
/var/log/lpr.log - I assume based on the filename that this relates to printer messages.
/var/log/mail.log - Messages relating to mail, etc. (also mail.info, mail.warn and mail.err)
/var/log/user.log - Not altogether sure what this is.
/var/log/uucp.log - This will probably be empty unless you're into using sz or anything like that.
/var/log/syslog - Stores all other messages. This will be where you'll find your cron jobs, unless Ubuntu does it differently - in which case you'll probably find it in /var/log/cron.log.

You can find these yourself in /etc/syslog.conf, in case Ubuntu differs in that regard.

It's so you can tell when a crash happened by looking for a gap in the messages. Sometimes there aren't enough normal messages generated to make that possible.