Logwatch searches through the logs produced by services running.
Those services write logs in
The logs to watch are defined in
/etc/logwatch and the cron / acron kick it off when needed.
usually at 4:xx a.m
acron is for missed crons so acron will run about 70 minutes after you boot up.
logwatch only processes the last days activity and sends a summary report to roots mail.
There are several times periods also.
Logwatch standard, logwatch roll logs (Fridays)
A updatedb for locate or find.
Then, usually after a major update or install,
a makewhat is runs, very intense and runs about 30 minutes.
Some run when needed, but mostly in the early am hours, so if yor computer is off,
acron will run about 70 minutes after boot up.
When several of these get occur at once, it seems like your computer is possessed
But the info and work done is very useful..