1

I've got a system with Ubuntu 12.04 which has rkhunter installed. Currently the rkhunter daily scan script is located in /etc/cron.daily/rkhunter.

Every day at 7pm EST the rkhunter script is executed and the following is added to the /var/log/rkhunter.log file:

Info: Start date is Tue May 22 19:00:29 EDT 2012

However, here are the contents of my /etc/crontab file:

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 3   * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

If I'm reading this correctly, it should be executing at 3:25am, not 7pm. I changed it from the default of 6:25 and nothing changed when the task actually executed.

The current output of date matches the local time on my machine. I also have restarted cron with sudo service cron restart since changing the crontab.

So, what am I missing here? Thanks!

Andrew Anderson
  • 121
  • 1
  • 5

4 Answers4

1

It turns out that ISPConfig has it's own scheduled task setup. In this file, /usr/local/ispconfig/server/mods-available/monitor_core_module.inc.php, there is a _monitorRkHunter function that was set to run the rkhunter scan at 2300 UTC.

Thanks for your help, guys!

Andrew Anderson
  • 121
  • 1
  • 5
0

Are there any other scripts located in /etc/cron.daily ? The entry in crontab is not about rkhunter in particular you see.

Maybe there are other scripts that get executed before rkhunter at 06:25.

(just a suggestion, I really have an idea).

gfountis
  • 1
  • 2
  • There are other scripts including apache2, ntp, aptitude, dpkg, etc. The thing is, though, the rkhunter script fires off at 1900 hours, not 0625, no matter what I change in the `/etc/crontab` file. Shouldn't that be what defines when the `/etc/cron.daily/` tasks run? – Andrew Anderson May 23 '12 at 14:04
  • Try adding the script in crontab by itself and not via cron.daily and see what it does. – gfountis May 23 '12 at 14:08
  • I just added a script to `/etc/crontab/` and it executed when it was supposed to (EST time). Are there any other scheduling systems Ubuntu uses? – Andrew Anderson May 24 '12 at 12:58
0

Try

sudo crontab -l root

If that lists the cronjob, well, then the cronjob is schuleded for root. Try then sudo crontab -e root and change the schedule at will.

Janne Pikkarainen
  • 31,454
  • 4
  • 56
  • 78
  • The rkhunter job isn't listed in the output of `crontab -l` when logged in as root. It just lists some ISPConfig tasks that run every 30 minutes or so. – Andrew Anderson May 23 '12 at 14:00
0

The cron system is actually much more complex than it appears. The entries in /etc/crontab run /usr/sbin/anacron if it is executable (test -x ...), and only run run-parts if it is not.

anacron changes the times tasks are run and can fire on wakeup for example. See: https://help.ubuntu.com/community/CronHowto#How_Anacron_is_Arranged

xofer
  • 3,052
  • 12
  • 19