I've got a system with Ubuntu 12.04 which has rkhunter installed. Currently the rkhunter daily scan script is located in /etc/cron.daily/rkhunter
.
Every day at 7pm EST the rkhunter script is executed and the following is added to the /var/log/rkhunter.log
file:
Info: Start date is Tue May 22 19:00:29 EDT 2012
However, here are the contents of my /etc/crontab
file:
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 3 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
If I'm reading this correctly, it should be executing at 3:25am, not 7pm. I changed it from the default of 6:25 and nothing changed when the task actually executed.
The current output of date
matches the local time on my machine. I also have restarted cron with sudo service cron restart
since changing the crontab.
So, what am I missing here? Thanks!
Best Answer
It turns out that ISPConfig has it's own scheduled task setup. In this file,
/usr/local/ispconfig/server/mods-available/monitor_core_module.inc.php
, there is a_monitorRkHunter
function that was set to run the rkhunter scan at 2300 UTC.Thanks for your help, guys!