PDA

View Full Version : Cron.daily logrotate happening at 4:20



pparks1
18th May 2006, 04:04 AM
I was digging around my FC5 box and noticed something strange.

I was looking at /etc/crontab and have the following:


# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly

I also have the following user based cron jobs defined


0 */4 * * * /usr/bin/rsnapshot hourly
0 6 * * * /usr/bin/rsnapshot daily > /dev/null 2>&1
0 22 * * 6 /usr/bin/rsnapshot weekly > /dev/null 2>&1
0 2 * * * /root/db-backup.sh > /dev/null 2>&1 &


According to /etc/crontab, the system should fire off the cron.daily task at 4:02am. Looking at the cron logs, it appears that the job indeed starts at 4:02am.


May 15 04:02:01 bessie crond[19478]: (root) CMD (run-parts /etc/cron.daily)
May 15 04:02:01 bessie anacron[19482]: Updated timestamp for job `cron.daily' to 2006-05-15


My /etc/cron.daily looks pretty standard;

-rwxr-xr-x 1 root root 276 Apr 13 21:14 0anacron
lrwxrwxrwx 1 root root 39 May 3 19:35 0logwatch -> /usr/share/logwatch/scripts/logwatch.pl
-rwxr-xr-x 1 root root 2780 Apr 21 07:18 beagle-crawl-system
-rwxr-xr-x 1 root root 118 Feb 11 01:45 cups
-rwxr-xr-x 1 root root 180 Feb 11 20:02 logrotate
-rwxr-xr-x 1 root root 418 Mar 24 03:55 makewhatis.cron
-rwxr-xr-x 1 root root 137 Mar 17 22:37 mlocate.cron
-rwxr-xr-x 1 root root 2133 Nov 23 2004 prelink
-rwxr-xr-x 1 root root 114 Feb 12 04:16 rpm
-rwxr-xr-x 1 root root 100 Apr 27 09:31 tetex.cron
-rwxr-xr-x 1 root root 290 Feb 12 13:06 tmpwatch
-rwxr-xr-x 1 root root 158 Mar 7 00:05 yum.cron


What I find odd, is that in /var/log my logrotations seem to be happening at 4:20am


-rw------- 1 root root 8607 May 17 22:37 secure
-rw------- 1 root root 1211 May 17 04:20 secure.1
-rw------- 1 root root 11197 May 16 04:20 secure.2
-rw------- 1 root root 10925 May 15 04:20 secure.3
-rw------- 1 root root 8527 May 14 04:20 secure.4
-rw------- 1 root root 10603 May 13 04:20 secure.5


-rw-r--r-- 1 root root 27379 May 17 04:20 rpmpkgs
-rw-r--r-- 1 root root 27262 May 13 04:20 rpmpkgs.1
-rw-r--r-- 1 root root 27262 May 6 04:20 rpmpkgs.2


Any thoughts as to why these logs rotate at 4:20am and not 4:02?

pparks1
18th May 2006, 04:43 AM
Darn....I should have looked a little longer before posting.

It appears that the Beagle Index is touching each of these files at 4:20am. So, I believe they do get rotated corrected at 4:02 according to crontab, but then they get touched a bit later by the beagle index process.

jhetrick62
18th May 2006, 04:47 AM
Mine get rotated at 4:02 it says. I don't know that beagle is bothering it, but I have never touched those settings.
Jeff

pparks1
18th May 2006, 04:53 AM
every day at approx 4:20am, I would get this in my logs. These would always be the very last lines in the file and always finishing at 4:20am.


May 17 04:19:37 bessie su: pam_unix(su:session): session opened for user beagleindex by (uid=0)
May 17 04:19:43 bessie su: pam_unix(su:session): session closed for user beagleindex
May 17 04:19:43 bessie su: pam_unix(su:session): session opened for user beagleindex by (uid=0)
May 17 04:20:04 bessie su: pam_unix(su:session): session closed for user beagleindex

I never use beagle anyway, so I performed

rpm -e beagle

I'm betting that my timing problem is fixed tonight :D