Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've got a system with Ubuntu 12.04 which has rkhunter installed. Currently the rkhunter daily scan script is located in /etc/cron.daily/rkhunter.

Every day at 7pm EST the rkhunter script is executed and the following is added to the /var/log/rkhunter.log file:

Info: Start date is Tue May 22 19:00:29 EDT 2012

However, here are the contents of my /etc/crontab file:

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 3   * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

If I'm reading this correctly, it should be executing at 3:25am, not 7pm. I changed it from the default of 6:25 and nothing changed when the task actually executed.

The current output of date matches the local time on my machine. I also have restarted cron with sudo service cron restart since changing the crontab.

So, what am I missing here? Thanks!

share|improve this question

4 Answers 4

up vote 1 down vote accepted

It turns out that ISPConfig has it's own scheduled task setup. In this file, /usr/local/ispconfig/server/mods-available/monitor_core_module.inc.php, there is a _monitorRkHunter function that was set to run the rkhunter scan at 2300 UTC.

Thanks for your help, guys!

share|improve this answer

Are there any other scripts located in /etc/cron.daily ? The entry in crontab is not about rkhunter in particular you see.

Maybe there are other scripts that get executed before rkhunter at 06:25.

(just a suggestion, I really have an idea).

share|improve this answer
    
There are other scripts including apache2, ntp, aptitude, dpkg, etc. The thing is, though, the rkhunter script fires off at 1900 hours, not 0625, no matter what I change in the /etc/crontab file. Shouldn't that be what defines when the /etc/cron.daily/ tasks run? –  Andrew Anderson May 23 '12 at 14:04
    
Try adding the script in crontab by itself and not via cron.daily and see what it does. –  gfountis May 23 '12 at 14:08
    
I just added a script to /etc/crontab/ and it executed when it was supposed to (EST time). Are there any other scheduling systems Ubuntu uses? –  Andrew Anderson May 24 '12 at 12:58

Try

sudo crontab -l root

If that lists the cronjob, well, then the cronjob is schuleded for root. Try then sudo crontab -e root and change the schedule at will.

share|improve this answer
    
The rkhunter job isn't listed in the output of crontab -l when logged in as root. It just lists some ISPConfig tasks that run every 30 minutes or so. –  Andrew Anderson May 23 '12 at 14:00

The cron system is actually much more complex than it appears. The entries in /etc/crontab run /usr/sbin/anacron if it is executable (test -x ...), and only run run-parts if it is not.

anacron changes the times tasks are run and can fire on wakeup for example. See: https://help.ubuntu.com/community/CronHowto#How_Anacron_is_Arranged

share|improve this answer
    
anacron actually isn't installed. –  Andrew Anderson May 23 '12 at 16:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.