How to find out what is copying my backups from my hub each day

[simon4]

Ages ago I setup a backup routine that is copying my Hubitat backup files to a windows share. I am in the process of moving that share and I can't find where I am doing it.

I know it is happening at the time that the backup is created in Hubitat. So either this is triggered on backup completion or change of file. So far I have looked across all of my home network devices and have yet to find out what is copying the file.

So I thought I would look to the Hubitat logs to see what is happening at that time - presumably it will log an incoming connection when the file is copied?

So I went into past logs and I can't even seem to get to yesterdays logs, without clicking show more a thousand times. Clicking on Date filter only allows me to select the current day. Any suggestions?

Also, any thoughts on how I can hunt down what is connecting to the hub and copying the file? I am sure I am being a complete idiot and it is right in front of me - but at a loss to figure it out so far! Thanks.

[thebearmay]

If it’s going to a Windows share my first thought would be to check the Windows Scheduler.

[simon4]

Yep checked there. Nothing that matches and nothing ran yesterday when the last copy took place.

How do I zero in on the Hubitat logs for 10:23am yesterday? Presumably the Hubitat has to log a connection coming in? Thanks.

[thebearmay]

Doubt that you’ll find anything there unless there is an app that is creating log entries (backups don’t log anywhere but their settings page). Are you running any other devices that could issue a wget?

[simon4]

How would I look for this? I searched through all device names for something obvious - including the word backup or copy. I looked through the rules at a high level for something similar. There doesn't appear to be anyway to search through the content of rules to see if I have a wget in there. Also none of the rule names give me any reason to expect that I put a random wget in there. But I will check anyway.

Scratching my head.

[thebearmay]

Maybe look at the security for the Share to see if you defined any special users for it.

[simon4]

Thanks @thebearmay I found it! A script running on my Synology NAS that was copying the backups to the NAS. Then when the backup to my NAS from the windows share ran (another process) it was set to mirror and it pulled the backups down from the NAS - making it seem like they originated there.

The NAS is running a curl against the Hubitat to pull the files - so it would have been easier if I could look at the Hubitat logs and see when this request was coming in and from where. But mystery solved.