I've got a system with Ubuntu 12.04 which has rkhunter installed. Currently the rkhunter daily scan script is located in /etc/cron.daily/rkhunter.

Every day at 7pm EST the rkhunter script is executed and the following is added to the /var/log/rkhunter.log file:

Info: Start date is Tue May 22 19:00:29 EDT 2012

However, here are the contents of my /etc/crontab file:


# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 3   * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

If I'm reading this correctly, it should be executing at 3:25am, not 7pm. I changed it from the default of 6:25 and nothing changed when the task actually executed.

The current output of date matches the local time on my machine. I also have restarted cron with sudo service cron restart since changing the crontab.

So, what am I missing here? Thanks!

4 Answers 4


It turns out that ISPConfig has it's own scheduled task setup. In this file, /usr/local/ispconfig/server/mods-available/monitor_core_module.inc.php, there is a _monitorRkHunter function that was set to run the rkhunter scan at 2300 UTC.

Thanks for your help, guys!


Are there any other scripts located in /etc/cron.daily ? The entry in crontab is not about rkhunter in particular you see.

Maybe there are other scripts that get executed before rkhunter at 06:25.

(just a suggestion, I really have an idea).

  • There are other scripts including apache2, ntp, aptitude, dpkg, etc. The thing is, though, the rkhunter script fires off at 1900 hours, not 0625, no matter what I change in the /etc/crontab file. Shouldn't that be what defines when the /etc/cron.daily/ tasks run? May 23, 2012 at 14:04
  • Try adding the script in crontab by itself and not via cron.daily and see what it does.
    – gfountis
    May 23, 2012 at 14:08
  • I just added a script to /etc/crontab/ and it executed when it was supposed to (EST time). Are there any other scheduling systems Ubuntu uses? May 24, 2012 at 12:58


sudo crontab -l root

If that lists the cronjob, well, then the cronjob is schuleded for root. Try then sudo crontab -e root and change the schedule at will.

  • The rkhunter job isn't listed in the output of crontab -l when logged in as root. It just lists some ISPConfig tasks that run every 30 minutes or so. May 23, 2012 at 14:00

The cron system is actually much more complex than it appears. The entries in /etc/crontab run /usr/sbin/anacron if it is executable (test -x ...), and only run run-parts if it is not.

anacron changes the times tasks are run and can fire on wakeup for example. See: https://help.ubuntu.com/community/CronHowto#How_Anacron_is_Arranged

  • anacron actually isn't installed. May 23, 2012 at 16:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.