ok - descobri. Postando de volta apenas encaixotar se alguém corre para ele algum dia em algum momento. The % sign has a special meaning in crontab. it's changed to newline and any string after the first % will be sent to the command as standard input. To force cron to interpret it literally, you have to escape it
:
00 18 * * * rsync -a -v --delete -e ssh user@centosvm:/home/user/rsync-test ~/backup > ~/rsync$(date +\%Y\%m\%d_\%H\%M\%S).log 2>&1