Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've been using kSar to look at my servers resource use. There is a definite spike in process creation at 4:04AM daily. Cron seems to define the interval they should be run, but not the specific time

How can I find what cron job runs at that time?

share|improve this question
1  
How does cron seem to do that? Doesn't your cron log what it is going to execute? –  Hauke Laging Feb 14 at 14:05

2 Answers 2

up vote 4 down vote accepted

If you look at any CentOS 5 or 6 system the file /etc/crontab is typically where all the action starts. There are 4 directories that will contain various scripts. These directories are named:

$ ls -1d /etc/cron*
/etc/cron.d
/etc/cron.daily
/etc/cron.deny
/etc/cron.hourly
/etc/cron.monthly
/etc/crontab
/etc/cron.weekly

The /etc/cron.d and /etc/cron.deny are special so I'm not going to discuss them. The remaining 4 directories: hourly, daily, weekly, & monthly are for exactly what their names imply. But when do they run? Take a look at the /etc/crontab to find that out.

######################################################################
## run-parts
##
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly
######################################################################

Your issue with something running daily @ 4:04AM? It's the /etc/cron.daily directory that's causing this. You'll need to familiarize yourself with what's in that directory to know what the actual culprit is. But if I had to guess it's likely one of these 2 guys:

$ ls -l /etc/cron.daily
logrotate
mlocate.cron

What else is running?

If you have a deviant cron that's tanking your system always consult the log file. Here's everything running at 4AM on my CentOS 5 system:

$ grep " 04:" /var/log/cron | head -10
Feb  9 04:10:01 skinner crond[25640]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:20:02 skinner crond[27086]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:22:01 skinner crond[27432]: (root) CMD (run-parts /etc/cron.weekly)
Feb  9 04:22:01 skinner anacron[27436]: Updated timestamp for job `cron.weekly' to 2014-02-09
Feb  9 04:30:01 skinner crond[28561]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:40:01 skinner crond[30022]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:50:01 skinner crond[31482]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 10 04:00:02 skinner crond[7578]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 10 04:01:01 skinner crond[7700]: (root) CMD (run-parts /etc/cron.hourly)
Feb 10 04:02:01 skinner crond[7934]: (root) CMD (run-parts /etc/cron.daily)

Notice the 04:02 AM time slots?

share|improve this answer

The previous answer doesn't take into account per-user cronjobs.

Also check out:

 /var/spool/cron/crontabs 
share|improve this answer
1  
I intentionally left those out since if you're familiar with CentOS or RH distros the 4AM crons are ...wait for it...legendary. Esp. if you run servers. –  slm Feb 14 at 14:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.