We have an ongoing problem with one content database (there are several others that are unaffected): the transaction log is enormous and the bandaid is to add space to the backup drive (yes, I can hear you choking on your coffee, please let that slide for now).
Here's what I know:
IT Site Collection > Projects sub site > Site Contents
All subsites of the Projects site are showing as "Modified 3 minutes ago".
Depending on when I look, this value may be 1 or 2 or 3, up to 6 minutes ago.
IT Site Collection > Projects sub site > Site Contents > Child site > Site Contents
Documents doc lib shows Modified 3 minute ago
No other lists or apps are listed as modified sooner than 2 weeks ago.
IT Site Collection > Projects sub site > Site Contents > Child site > Site Contents > Documents doc lib (not settings)
Nothing was modified sooner ago than 43 minutes
IT Site Collection > Site Contents
AllITDocuments doc lib was modified 2 minutes ago.
The most recently edited file was about an hour ago.
IT Site Collection > Site Contents > a custom list (with 4 items in it) shows as modified 3 minutes ago.
The most recent change to this list was in 2013.
Our DBA ran an audit that showed that the doc lib in italics above is showing up in an Event Cache list as having 15,189 recent actions performed on it, compared with from 1 to 5000 or so on other lists.
Something is making changes to the database every minute or so, but we can't query the db to find out because we don't know what to look for.
Has anyone seen anything like this and how do I fix it? Our bandaid is obviously unsustainable and we need this mystery solved.