According to this site, your string means “At 11:00 on the 24, 25, 26, 27, 28, 29, 30 and 31st of every month and every Thu.” (my emphasis). If the site is correct this would explain why it ran on 18th.
The example entry in man 5 crontab to run on 2nd Saturday is:
0 4 8-14 * * test $(date +\%u) -eq 6 && echo "2nd Saturday" (ie run every day of the second week and check for the week day as part of the command) - this supports the view that the week day is an additional, alternative filter, not a further qualification, though the manual page does not make it clear.
So in your case I would use:
00 11 * * 4 root test $(date -d @$((`date +\%s`+604800)) +\%m) -ne $(date +\%m) && /usr/bin/rsnapshot monthly > /backups/rsnapshot_cron.txt 2>&1 Check if your date supports -d 'next Thursday': if so you can use the rather simpler:
00 11 * * 4 root test $(date -d 'next Thu' +\%m) -ne $(date +\%m) && /usr/bin/rsnapshot monthly > /backups/rsnapshot_cron.txt 2>&1 This runs every Thursday and checks if the date a week (604800 seconds) from now is in the same month: if not, it must be the last Thursday so the back-up command runs.