I took a look in the source -- it is definitely asterisk -r (or rasterisk) and not AMI. AMI logs something like "Manager 'username' logged on from 127.0.0.1". Check the timing between calls and see if a pattern appears. If so, it is some sort of cron/scheduled job. If not, keep looking! -M