6

I've been using kSar to look at my servers resource use. There is a definite spike in process creation at 4:04AM daily. Cron seems to define the interval they should be run, but not the specific time

How can I find what cron job runs at that time?

1
  • 1
    How does cron seem to do that? Doesn't your cron log what it is going to execute? Feb 14, 2014 at 14:05

2 Answers 2

6

If you look at any CentOS 5 or 6 system the file /etc/crontab is typically where all the action starts. There are 4 directories that will contain various scripts. These directories are named:

$ ls -1d /etc/cron*
/etc/cron.d
/etc/cron.daily
/etc/cron.deny
/etc/cron.hourly
/etc/cron.monthly
/etc/crontab
/etc/cron.weekly

The /etc/cron.d and /etc/cron.deny are special so I'm not going to discuss them. The remaining 4 directories: hourly, daily, weekly, & monthly are for exactly what their names imply. But when do they run? Take a look at the /etc/crontab to find that out.

######################################################################
## run-parts
##
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly
######################################################################

Your issue with something running daily @ 4:04AM? It's the /etc/cron.daily directory that's causing this. You'll need to familiarize yourself with what's in that directory to know what the actual culprit is. But if I had to guess it's likely one of these 2 guys:

$ ls -l /etc/cron.daily
logrotate
mlocate.cron

What else is running?

If you have a deviant cron that's tanking your system always consult the log file. Here's everything running at 4AM on my CentOS 5 system:

$ grep " 04:" /var/log/cron | head -10
Feb  9 04:10:01 skinner crond[25640]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:20:02 skinner crond[27086]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:22:01 skinner crond[27432]: (root) CMD (run-parts /etc/cron.weekly)
Feb  9 04:22:01 skinner anacron[27436]: Updated timestamp for job `cron.weekly' to 2014-02-09
Feb  9 04:30:01 skinner crond[28561]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:40:01 skinner crond[30022]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:50:01 skinner crond[31482]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 10 04:00:02 skinner crond[7578]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 10 04:01:01 skinner crond[7700]: (root) CMD (run-parts /etc/cron.hourly)
Feb 10 04:02:01 skinner crond[7934]: (root) CMD (run-parts /etc/cron.daily)

Notice the 04:02 AM time slots?

4

The previous answer doesn't take into account per-user cronjobs.

Also check out:

 /var/spool/cron/crontabs 
1
  • 1
    I intentionally left those out since if you're familiar with CentOS or RH distros the 4AM crons are ...wait for it...legendary. Esp. if you run servers.
    – slm
    Feb 14, 2014 at 14:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .