6

I've been using kSar to look at my servers resource use. There is a definite spike in process creation at 4:04AM daily. Cron seems to define the interval they should be run, but not the specific time

How can I find what cron job runs at that time?

  • 1
    How does cron seem to do that? Doesn't your cron log what it is going to execute? – Hauke Laging Feb 14 '14 at 14:05
6

If you look at any CentOS 5 or 6 system the file /etc/crontab is typically where all the action starts. There are 4 directories that will contain various scripts. These directories are named:

$ ls -1d /etc/cron*
/etc/cron.d
/etc/cron.daily
/etc/cron.deny
/etc/cron.hourly
/etc/cron.monthly
/etc/crontab
/etc/cron.weekly

The /etc/cron.d and /etc/cron.deny are special so I'm not going to discuss them. The remaining 4 directories: hourly, daily, weekly, & monthly are for exactly what their names imply. But when do they run? Take a look at the /etc/crontab to find that out.

######################################################################
## run-parts
##
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly
######################################################################

Your issue with something running daily @ 4:04AM? It's the /etc/cron.daily directory that's causing this. You'll need to familiarize yourself with what's in that directory to know what the actual culprit is. But if I had to guess it's likely one of these 2 guys:

$ ls -l /etc/cron.daily
logrotate
mlocate.cron

What else is running?

If you have a deviant cron that's tanking your system always consult the log file. Here's everything running at 4AM on my CentOS 5 system:

$ grep " 04:" /var/log/cron | head -10
Feb  9 04:10:01 skinner crond[25640]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:20:02 skinner crond[27086]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:22:01 skinner crond[27432]: (root) CMD (run-parts /etc/cron.weekly)
Feb  9 04:22:01 skinner anacron[27436]: Updated timestamp for job `cron.weekly' to 2014-02-09
Feb  9 04:30:01 skinner crond[28561]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:40:01 skinner crond[30022]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb  9 04:50:01 skinner crond[31482]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 10 04:00:02 skinner crond[7578]: (root) CMD (/usr/lib/sa/sa1 1 1)
Feb 10 04:01:01 skinner crond[7700]: (root) CMD (run-parts /etc/cron.hourly)
Feb 10 04:02:01 skinner crond[7934]: (root) CMD (run-parts /etc/cron.daily)

Notice the 04:02 AM time slots?

4

The previous answer doesn't take into account per-user cronjobs.

Also check out:

 /var/spool/cron/crontabs 
  • 1
    I intentionally left those out since if you're familiar with CentOS or RH distros the 4AM crons are ...wait for it...legendary. Esp. if you run servers. – slm Feb 14 '14 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.