If you relate this to a scheduled event calling a java action I think limiting your options is the way to go: - Exclude the scheduled event which don't have custom java from the suspicion list (maybe none ;-) ) - Add a log activity at the start and end of each suspicious Scheduled event; logging start/end time & name of SE
Next StackOverflow error, a scheduled event has been started and never ended. So that must be the one.
Or am I to easy on this?