auth.log:Dec 12 09:14:01 ps17185 CRON[22094]: (pam_unix) session opened for user root by (uid=0)
auth.log:Dec 12 09:14:01 ps17185 CRON[22094]: (pam_unix) session closed for user root
auth.log:Dec 12 09:15:01 ps17185 CRON[22788]: (pam_unix) session opened for user root by (uid=0)
auth.log:Dec 12 09:15:01 ps17185 CRON[22787]: (pam_unix) session opened for user root by (uid=0)
auth.log:Dec 12 09:15:01 ps17185 CRON[22787]: (pam_unix) session closed for user root
auth.log:Dec 12 09:15:01 ps17185 CRON[22792]: (pam_unix) session opened for user drook by (uid=0)
auth.log:Dec 12 09:15:01 ps17185 CRON[22788]: (pam_unix) session closed for user root
auth.log:Dec 12 09:15:04 ps17185 CRON[22792]: (pam_unix) session closed for user drook
auth.log:Dec 12 09:16:01 ps17185 CRON[23731]: (pam_unix) session opened for user root by (uid=0)
auth.log:Dec 12 09:16:01 ps17185 CRON[23731]: (pam_unix) session closed for user root
That shows a single instance of it for my user at 15 after the hour, which is correct. But I still don't trust it. Need to create a copy of the script with heavy debugging in it but not actually send the email and cron that.