Crontab File Empty But Jobs Running

Question

I'm having a hard time understanding some cron behavior that I was wondering if someone might be able to shed some light on.

I have a server running Centos 6.6. If I run "sudo cat /etc/crontab", the following output is displayed:

SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# For details see man 4 crontabs

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR 
sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed

As you can see, there are no actual jobs configured in the system crontab file. However, jobs are indeed getting run from the /etc/cron.d/, /etc/cron.daily/, and /etc/cron.hourly/ directories as you can see from the /var/log/cron file:

Jul 29 03:38:01 <servername> run-parts(/etc/cron.daily)[26524]: finished logrotate
Jul 29 03:38:01 <servername> run-parts(/etc/cron.daily)[26494]: starting update_phishing_sites
Jul 29 03:42:04 <servername> run-parts(/etc/cron.daily)[26565]: finished update_phishing_sites
Jul 29 03:42:04 <servername> run-parts(/etc/cron.daily)[26494]: starting update_spamassassin
Jul 29 03:45:02 <servername> run-parts(/etc/cron.daily)[26587]: finished update_spamassassin
Jul 29 03:45:02 <servername> anacron[26044]: Job `cron.daily' terminated (mailing output)
Jul 29 03:45:02 <servername> anacron[26044]: Normal exit (1 job run)
Jul 29 04:01:01 <servername> CROND[26719]: (root) CMD (run-parts /etc/cron.hourly)
Jul 29 04:01:01 <servername> run-parts(/etc/cron.hourly)[26719]: starting 0anacron
Jul 29 04:01:01 <servername> run-parts(/etc/cron.hourly)[26728]: finished 0anacron
Jul 29 04:01:01 <servername> run-parts(/etc/cron.hourly)[26719]: starting check_MailScanner
Jul 29 04:01:02 <servername> run-parts(/etc/cron.hourly)[26752]: finished check_MailScanner
Jul 29 04:01:02 <servername> run-parts(/etc/cron.hourly)[26719]: starting processing_messages_alert
Jul 29 04:01:02 <servername> run-parts(/etc/cron.hourly)[26766]: finished processing_messages_alert
Jul 29 04:01:02 <servername> run-parts(/etc/cron.hourly)[26719]: starting update_bad_phishing_sites
Jul 29 04:08:37 <servername> run-parts(/etc/cron.hourly)[26863]: finished update_bad_phishing_sites
Jul 29 04:08:37 <servername> run-parts(/etc/cron.hourly)[26719]: starting update_virus_scanners
Jul 29 04:14:52 <servername> run-parts(/etc/cron.hourly)[27187]: finished update_virus_scanners

My question is, what/where/how are those jobs being kicked off? I've seen examples online where the /etc/crontab file looks something like this:

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly

If my /etc/crontab file contained these entries then I would understand how the jobs are getting kicked off. However as stated above, my /etc/crontab file does not contain these entries.

Chris

Can you show the contents of your user specific crontab file, by running crontab -e? — roelofs
@roelofs, thanks for the response and trying to help out. I actually ended up figuring it out, see my answer below. I was struggling for quite sometime to figure it out ... I should have stuck with it just a little longer before posting the question. — user2634876

user2634876 user2634876 · Accepted Answer · 2018-08-01T04:00:39

I should have just spent a few more minutes looking into things before posting the question because I found out how the jobs were being kicked off. The man page for crond on my server states the following:

/etc/crontab
          system  crontab.   Nowadays the file is empty by default.  Originally it was usually used to run daily, weekly, monthly jobs.  By default these jobs
          are now run through anacron which reads /etc/anacrontab configuration file.  See anacrontab(5) for more details.

If I look at the /etc/anacrontab file, it contains the following:

# /etc/anacrontab: configuration file for anacron

# See anacron(8) and anacrontab(5) for details.

SHELL=/bin/sh
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
# the maximal random delay added to the base delay of the jobs
RANDOM_DELAY=45
# the jobs will be started during the following hours only
START_HOURS_RANGE=3-22

#period in days   delay in minutes   job-identifier   command
1       5       cron.daily              nice run-parts /etc/cron.daily
7       25      cron.weekly             nice run-parts /etc/cron.weekly
@monthly 45     cron.monthly            nice run-parts /etc/cron.monthly

So, that's how they are being kicked off. :)

Crontab File Empty But Jobs Running

1 Answers