Why by default, configured to rotate the log file after 3AM or 4AM?
The knowledge base article is fairly clear on how that's tuned, where instead of the default 3am - 10pm (3-22) you can narrow that down with the START_HOURS_RANGE. It has to manage all the tasks in cron.daily, cron.weekly, and cron.monthly, so the timing, whereas consistent, isn't exact, but allows you to specify your window of lesser system resource needs on a daily basis to run system jobs. If I can attempt to answer your questions directly:
- Because all cron jobs can be started at 3am, and anacron is set to manage jobs within the /etc/cron.daily directory, and the logrotation job is in that directory, it gets run as anacron gets to it amongst the other tasks in that and other directories.
- START_RANGE_HOURS is just a window of opportunity for anacron to kick off jobs. Think of anacron as your casual "whatever" dude who is not concerned about WHEN the job will get done, only that it will get done eventually.
it happens "at least" after 3am because the START_HOURS_RANGE for the tasks anacron runs is set to begin at 3am. It can be something different if you change that value, that default value is arbitrary and can/should be changed to match the best times in your traffic distribution to manage system tasks.