Pulse Machine groups?

I just inherited a pipeline that utilizes Deadline.

I have several nodes that seem to automatically go from one machine group to another every morning at 8am.
upon looking at the slave history I find this:

2016/09/27 19:00:03 renderusr (web service) NAMEOFSERVER (DOMAIN\renderusr): Added group(s): [ae,none,comp,renderfarm]. 2016/09/28 08:00:04 renderusr (web service) NAMEOFSERVER (DOMAIN\renderusr): Added group(s): [ae,comp].

If I go to the said server and pull up the Pulse logs I see this

@ 7pm

2016-09-27 19:00:03: Web Service - Request: PUT http://NAMEOFSERVER:8080/api/groups 2016-09-27 19:00:03: Web Service - Found API command: groups

@8am

2016-09-28 08:00:04: Web Service - Request: PUT http://NAMEOFSERVER:8080/api/groups 2016-09-28 08:00:04: Web Service - Found API command: groups

How is this taking place? How do I find what is sending these commands?

Well, someone has written a script to interact with the group mappings, that’s for sure.

I don’t believe we log the client side requests URLs in verbose logging… If I were you, you can use tcpdump or Wireshark to watch for those requests. Both are capable of showing you the requests and their origins as they come in over the network. If there aren’t any requests coming in, then it’s coming from inside the server scary music (sorry, good mood this morning)!

If that’s the case, what OS is the Pulse / WebService server?