How to find source and targhet of data transmissions

[Colin Law]

On Sun, 3 Mar 2019 at 06:48, Bret Busby <bret.busby at gmail.com> wrote:
>
> On 03/03/2019, Colin Law <clanlaw at gmail.com> wrote:
> > On Sat, 2 Mar 2019 at 20:22, Bret Busby <bret.busby at gmail.com> wrote:
> >> ...
> >> It was set to perform daily checks for updates.
> >>
> >> Not to download or install.
> >>
> >> It had overriddren the settings.
> >
> > Do you mean it *was* set not to download or install but the settings
> > had changed or it was still set like that but was downloading them
> > anyway.
> >
> > Colin
> >
>
>
> The latter - the settings are still as they had been set; to daily
> check for updates, and not more than that, and it was doownloading and
> installing packages, anyway.

Can you post a bit of the apt log for that period (when it was
installing packages)?  That is in var/log/apt/history.log, or if the
log has been rotated since it happened /var/log/apt/history.log.1.gz,
or for older .2.gz etc.  You can look at the timestamps to find the
right one.

Colin