Access denied for user 'root'@'localhost' What proces is causing this?
One way to do this might be by finding out what local processes have the MySQL socket file open. First, determine where your socket file is. Not sure where it is on Debian, try /tmp/mysql.sock or /var/lib/mysql/mysql.sock, or check my.cnf for the location. 

Next, since the failing connection comes and goes, you will need to "freeze" it temporarily in order to catch it in the act. You can do it by stopping the mysqld process. For example, run pgrep -l mysqld to determine its process ID, then sudo kill -STOP &lt;PID&gt; (replace &lt;PID&gt; with the actual ID, obviously).

Now you can run sudo lsof | grep mysql.sock (or whatever your socket file happens to be) to see every process that has the file open.

To "un-freeze" mysqld, run sudo kill -CONT &lt;mysqld PID&gt;