I've been using kSar to look at my servers resource use. There is a definite spike in process creation at 4:04AM daily. Cron seems to define the interval they should be run, but not the specific time
How can I find what cron job runs at that time?
If you look at any CentOS 5 or 6 system the file /etc/crontab
is typically where all the action starts. There are 4 directories that will contain various scripts. These directories are named:
$ ls -1d /etc/cron*
/etc/cron.d
/etc/cron.daily
/etc/cron.deny
/etc/cron.hourly
/etc/cron.monthly
/etc/crontab
/etc/cron.weekly
The /etc/cron.d
and /etc/cron.deny
are special so I'm not going to discuss them. The remaining 4 directories: hourly, daily, weekly, & monthly are for exactly what their names imply. But when do they run? Take a look at the /etc/crontab
to find that out.
######################################################################
## run-parts
##
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly
######################################################################
Your issue with something running daily @ 4:04AM? It's the /etc/cron.daily
directory that's causing this. You'll need to familiarize yourself with what's in that directory to know what the actual culprit is. But if I had to guess it's likely one of these 2 guys:
$ ls -l /etc/cron.daily
logrotate
mlocate.cron
If you have a deviant cron that's tanking your system always consult the log file. Here's everything running at 4AM on my CentOS 5 system:
$ grep " 04:" /var/log/cron | head -10
Feb 9 04:10:01 skinner crond[25640]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 9 04:20:02 skinner crond[27086]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 9 04:22:01 skinner crond[27432]: (root) CMD (run-parts /etc/cron.weekly)
Feb 9 04:22:01 skinner anacron[27436]: Updated timestamp for job `cron.weekly' to 2014-02-09
Feb 9 04:30:01 skinner crond[28561]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 9 04:40:01 skinner crond[30022]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 9 04:50:01 skinner crond[31482]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 10 04:00:02 skinner crond[7578]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 10 04:01:01 skinner crond[7700]: (root) CMD (run-parts /etc/cron.hourly)
Feb 10 04:02:01 skinner crond[7934]: (root) CMD (run-parts /etc/cron.daily)
Notice the 04:02 AM time slots?
The previous answer doesn't take into account per-user cronjobs.
Also check out:
/var/spool/cron/crontabs
cron
seem to do that? Doesn't yourcron
log what it is going to execute?