I've been using kSar to look at my servers resource use. There is a definite spike in process creation at 4:04AM daily. Cron seems to define the interval they should be run, but not the specific timeHow can I find what cron job runs at that time?
How to find a cron job if you know the specific time it runs?
centos;cron
If you look at any CentOS 5 or 6 system the file /etc/crontab is typically where all the action starts. There are 4 directories that will contain various scripts. These directories are named:$ ls -1d /etc/cron*/etc/cron.d/etc/cron.daily/etc/cron.deny/etc/cron.hourly/etc/cron.monthly/etc/crontab/etc/cron.weeklyThe /etc/cron.d and /etc/cron.deny are special so I'm not going to discuss them. The remaining 4 directories: hourly, daily, weekly, & monthly are for exactly what their names imply. But when do they run? Take a look at the /etc/crontab to find that out.######################################################################## run-parts##01 * * * * root run-parts /etc/cron.hourly02 4 * * * root run-parts /etc/cron.daily22 4 * * 0 root run-parts /etc/cron.weekly42 4 1 * * root run-parts /etc/cron.monthly######################################################################Your issue with something running daily @ 4:04AM? It's the /etc/cron.daily directory that's causing this. You'll need to familiarize yourself with what's in that directory to know what the actual culprit is. But if I had to guess it's likely one of these 2 guys:$ ls -l /etc/cron.dailylogrotatemlocate.cronWhat else is running?If you have a deviant cron that's tanking your system always consult the log file. Here's everything running at 4AM on my CentOS 5 system:$ grep  04: /var/log/cron | head -10Feb  9 04:10:01 skinner crond[25640]: (root) CMD (/usr/lib/sa/sa1 1 1)Feb  9 04:20:02 skinner crond[27086]: (root) CMD (/usr/lib/sa/sa1 1 1)Feb  9 04:22:01 skinner crond[27432]: (root) CMD (run-parts /etc/cron.weekly)Feb  9 04:22:01 skinner anacron[27436]: Updated timestamp for job `cron.weekly' to 2014-02-09Feb  9 04:30:01 skinner crond[28561]: (root) CMD (/usr/lib/sa/sa1 1 1)Feb  9 04:40:01 skinner crond[30022]: (root) CMD (/usr/lib/sa/sa1 1 1)Feb  9 04:50:01 skinner crond[31482]: (root) CMD (/usr/lib/sa/sa1 1 1)Feb 10 04:00:02 skinner crond[7578]: (root) CMD (/usr/lib/sa/sa1 1 1)Feb 10 04:01:01 skinner crond[7700]: (root) CMD (run-parts /etc/cron.hourly)Feb 10 04:02:01 skinner crond[7934]: (root) CMD (run-parts /etc/cron.daily)Notice the 04:02 AM time slots?