Arch Linux

ua4000

Member

Registered: 2015-10-14

Posts: 566

certbot.timer runs three times ?

I use certbot and enabled the automatic renewal with systemd, but the timer runs more than once a day:

$ sudo journalctl | egrep -i certbot
May 09 02:36:51 xx systemd[1]: certbot.timer: Adding 16h 54min 20.404244s random time.
May 09 16:54:45 xx systemd[1]: certbot.timer: Adding 13h 52min 57.660511s random time.
May 09 16:54:45 xx systemd[1]: certbot.timer: Adding 5h 56min 16.094840s random time.

May 10 01:57:40 xx systemd[1]: certbot.timer: Adding 23h 58min 53.814835s random time.
May 10 23:59:12 xx systemd[1]: certbot.timer: Adding 3h 42min 2.121628s random time.
May 10 23:59:12 xx systemd[1]: certbot.timer: Adding 5h 12min 55.431578s random time.

May 11 01:57:03 xx systemd[1]: certbot.timer: Adding 23h 26min 14.628968s random time.
May 11 23:26:19 xx systemd[1]: certbot.timer: Adding 20h 56min 46.689390s random time.
May 11 23:26:19 xx systemd[1]: certbot.timer: Adding 10h 38min 41.540029s random time.

May 12 04:02:19 xx systemd[1]: certbot.timer: Adding 22h 32min 26.378077s random time.
May 12 22:33:03 xx systemd[1]: certbot.timer: Adding 2h 32min 38.673925s random time.
May 12 22:33:03 xx systemd[1]: certbot.timer: Adding 22h 19min 2.653107s random time.

The first message per day is expected, here I do a systemctl daemon-reload.

$ cat /etc/systemd/system/certbot.service 
[Unit]
Description=Let's Encrypt renewal
[Service]
Type=oneshot
ExecStart=/usr/bin/certbot renew --quiet --agree-tos

$ cat /etc/systemd/system/certbot.timer
[Unit]
Description=Daily renewal of Let's Encrypt's certificates
[Timer]
OnCalendar=daily
RandomizedDelaySec=1day
Persistent=true
[Install]
WantedBy=timers.target

$  sudo systemctl is-enabled     certbot.service certbot.timer
static
enabled

Any ideas, what's wrong with my config?

ua4000

Member

Registered: 2015-10-14

Posts: 566

Re: certbot.timer runs three times ?

To avoid overlapping timers, I replaced "1day" in certbot.timer with

RandomizedDelaySec=20h

This doesn't help, journalctl has still 3 lines per day.

Also I verified with /var/log/letsencrypt/letsencrypt.log*: certbot.service runs only once a day, this matched also with list-timers:

$ systemctl list-timers --all
NEXT                          LEFT     LAST                          PASSED       UNIT                         ACTIVATES
Sun 2017-06-11 19:04:47 CEST  9h left  Sat 2017-06-10 06:27:17 CEST  1 day 3h ago certbot.timer                certbot.service
Mon 2017-06-12 00:00:00 CEST  13h left Mon 2017-06-05 00:00:01 CEST  6 days ago   fstrim.timer                 fstrim.service
Mon 2017-06-12 00:00:00 CEST  13h left Sun 2017-06-11 00:00:33 CEST  9h ago       logrotate.timer              logrotate.service
Mon 2017-06-12 00:00:00 CEST  13h left Sun 2017-06-11 00:00:33 CEST  9h ago       man-db.timer                 man-db.service
Mon 2017-06-12 00:00:00 CEST  13h left Mon 2017-06-05 00:00:01 CEST  6 days ago   pkgstats.timer               pkgstats.service
Mon 2017-06-12 00:00:00 CEST  13h left Sun 2017-06-11 00:00:33 CEST  9h ago       shadow.timer                 shadow.service
Mon 2017-06-12 06:55:02 CEST  20h left Sun 2017-06-11 06:55:02 CEST  3h 5min ago  systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service

7 timers listed.