The aim is to update a CentOS 7 system automatically.


Based on this documentation the following steps were executed:

  • yum-cron has been installed
  • The yum-cron.conf was changed as follows:

    user@host ~ $ cat /etc/yum/yum-cron.conf 
    update_cmd = default
    update_messages = yes
    download_updates = yes
    apply_updates = yes
  • The yum-cron was:

    • checked (systemctl status yum-cron)

      user@host ~ $ systemctl status yum-cron
      ● yum-cron.service - Run automatic yum updates as a cron job
      Loaded: loaded (/usr/lib/systemd/system/yum-cron.service; enabled; 
      vendor preset: disabled)
      Active: active (exited) since 
    • enabled (systemctl enable yum-cron)

    • started (systemctl start yum-cron)
  • After a couple of days the yum.log was checked

    user@host$ sudo cat /var/log/yum.log
    [sudo] password for user:
    Feb 23 18:49:51 Installed: libreoffice5.2-freedesktop-menus-5.2.5-1.noarch
    Mar 02 15:42:09 Installed: qpid-tools-1.35.0-1.el7.noarch
    Mar 27 08:41:33 Installed: yum-cron-3.4.3-150.el7.centos.noarch

but nothing was installed automatically. This was verified when yum upgrade indicated that multiple packages could be installed:

user@host$ sudo yum upgrade

Transaction Summary
Install    3 Packages (+2 Dependent packages)
Upgrade  155 Packages
Remove     2 Packages

Total size: 488 M
Total download size: 53 M
Is this ok [y/d/N]:


  • Q: Perhaps this issue is OS version related?

    user@host ~ $ cat /etc/redhat-release
    CentOS Linux release 7.3.1611 (Core)

    A: No evidence was found that this problem is related to CentOS 7.3.1611.

  • I wonder if the fact that yum-cron appears to have been pulled in as an update matters. Might be worthwhile to find a second example where it fails. – ILMostro_7 Mar 30 '17 at 16:54
  • Also, these options might be relevant: # Uncomment to auto-import new gpg keys (dangerous) # assumeyes = True and skip_broken=True – ILMostro_7 Mar 30 '17 at 17:00
  • Then I would expect that that is shown in the log (/var/log/yum.log) at least, .e.g. cannot install due to something – 030 Mar 30 '17 at 17:04
  • another way to troubleshoot, set it up to send message via e-mail when updates are available. No clue why it would've failed silently, if it did. – ILMostro_7 Mar 30 '17 at 17:06

You're missing a great deal of parameters that are in the default yum-cron.conf. I wonder if the omission of some of those parameters is what's causing your problem.

Here's one of my working yum-cron.conf setups, decrufted:

# grep -v -e '^#' -e '^$' yum-cron.conf 
update_cmd = default
update_messages = yes
download_updates = yes
apply_updates = yes
random_sleep = 10800
system_name = None
emit_via = stdio
ouput_width = 80
email_from = root@localhost
email_to = root
email_host = localhost
group_list = None
group_package_types = mandatory, default
debuglevel = -2
mdpolicy = group:main

Also, check to be sure /etc/cron.daily/0yum-cron.cron exists:


# Only run if this flag is set. The flag is created by the yum-cron init
# script when the service is started -- this allows one to use chkconfig and
# the standard "service stop|start" commands to enable or disable yum-cron.
if [[ ! -f /var/lock/subsys/yum-cron ]]; then
  exit 0

# Action!
exec /usr/sbin/yum-cron

Finally, make sure SELinux labels and basic unix permissions and ownership are correct. These values work:

# ls -Z /etc/cron.daily/0yum-daily.cron /etc/yum/yum-cron.conf
-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /etc/cron.daily/0yum-daily.cron
-rw-r--r--. root root unconfined_u:object_r:etc_t:s0   /etc/yum/yum-cron.conf
| improve this answer | |
  • 1
    I will try this tomorrow and let you know the outcome. – 030 Apr 5 '17 at 15:41
  • Once changed, should it work directly? When the /var/log/yum.log is checked then no reports regarding updated packages are registered. – 030 Apr 6 '17 at 8:00
  • I'm adding separate answers for different avenues of investigation. – Michael Mol Apr 7 '17 at 12:02
  • One thing I forgot to draw attention to were the UNIX permissions and ownership of /etc/cron.daily/0yum-cron.cron. They should be 0755 and root:root. – Michael Mol Apr 7 '17 at 12:12

One thing that may help diagnosing this is to check the root account's email. Any process Anacron runs, it will capture stdout and stderr and email those to the system root account. Also, yum-cron itself should send emails of any activity. It would be wise to forward root's mailbox to an email address you read.

Adding set -x near the beginning of /etc/cron.daily/0yum-cron.cron will result in sh echoing every command it's running, which can help you determine if Anacron is even being run, and if it's being run, whether the 0yum-cron.cron script is executing properly.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.