6

Some time ago, I set up a cron job to run a script every minute. Since then, I've upgraded the system from ubuntu intrepid to ubuntu karmic. Now the job is failing. I get email about it once a minute.

No problem, right? I can just solve the problem and go on my way. Well, ok, but I don't have time to do that right now, so I just want to shut the job off until I get around to it.

Ok, here's where it gets odd. I can't find the cron job. It's not in the crontab (under /var/spool/cron ) for the user (or any other user). It's not in /etc/crontab. It's not in /etc/cron.d. I've recursively grepped the whole of /etc/ and /var/ for the name of the script. Can't find it.

I've run lsof on the pid of the cron to see if it has some weird location I'm unfamiliar with open, no go.

What am I missing here? The job is running. It's being run by cron (Email comes from cron - I can see it in the system logs running under cron), but it doesn't appear to exist anywhere.

6 Answers6

8

On my Debian system, /var/log/syslog contains an entry for each cron job which is executed …

Jan 17 20:10:01 machine1 /USR/SBIN/CRON[1545]: (convict) CMD (fetchmail -s >/dev/null 2>&1)
Jan 17 20:17:01 machine1 /USR/SBIN/CRON[1800]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Jan 17 20:20:01 machine1 /USR/SBIN/CRON[1914]: (convict) CMD (fetchmail -s >/dev/null 2>&1)

If your job is being executed by cron, you should find a reference to it in /var/log/syslog.

Convict
  • 1,593
  • 9
  • 8
  • Yep. /var/log/syslog shows it executing, but as you'll notice in the examples you posted, it doesn't give any indication where the job itself is scheduled. –  Jan 18 '10 at 06:17
  • The log entry does show which user is executing the job. That gives an indication of where to look for the definition of the job. Please show your /var/log/syslog entry so that we can help you further. – Convict Jan 20 '10 at 04:12
  • Red hat: `/var/log/cron` – Joe Flynn Dec 18 '12 at 17:15
3

I have some things you can try that might help.

To see the cron jobs on the system, try this:

crontab -l

This is what I get (as I only have one job setup to run):

#CrInfo osascript -e "tell application "iTunes" to updateAllPodcasts"
30  2   *   *   *   osascript -e "tell application "iTunes" to updateAllPodcasts"

That will list the jobs that will run on a scheduled basis.

To list all the running processes on the system and their full filesystem paths type:

ps -xa

You'll get some output like this: (which should make it easier to know where to delete the script that runs your email)

 4968 ??         0:03.24 /Applications/Utilities/Terminal.app/Contents/MacOS/Terminal -psn_0_655520
 6112 ??         0:23.31 /Applications/QuickTime Player.app/Contents/MacOS/QuickTime Player -psn_0_712878
 7203 ??         4:33.38 /Applications/Transmit.app/Contents/MacOS/Transmit -psn_0_946407
 7240 ??         2:56.99 /Applications/Google Chrome.app/Contents/MacOS/Google Chrome -psn_0_975086
 7358 ??         0:00.02 /System/Library/PrivateFrameworks/KerberosHelper.framework/Resources/LKDCHelper
 7369 ??         0:04.72 /usr/sbin/AppleFileServer

There's also a page on IBM's site that might help you out with how to use Cron properly.

That said if your job doesn't appear in cron are you sure you aren't running it with some other tool that you've forgotten about? Some custom deamon application that you may have downloaded for example?

Brock Woolf
  • 212
  • 1
  • 7
  • As I said in my original post, I can see it running under cron in syslog. It's definitely being run by cron and nothing else. I'm quite familiar with how to operate cron "properly", as you say. The point is, the job does not appear to be scheduled in any of the normal places (or any abnormal ones either). –  Jan 18 '10 at 06:21
2

It may be in /etc/cron.daily (I assume it runs as root). Those jobs are not visible in crontab -l but still executed.

dtoubelis
  • 4,579
  • 1
  • 28
  • 31
1

I know this is 5 years old, but for anyone stumbling across this having the same problem (as I had) here is my solution:

I checked every users crontab with sudo crontab -e -u username Where "username" should be an existing username like "www-data" (which was the culprit in my case).

Hope this helps someone.

m7o
  • 111
  • 2
  • As other answer on this question states, it is not necessary to go through every account since the information is in system log. However `sudo crontab -e -u username` is a good addition showing a way to access it. It could be a comment instead of new answer, though. – Esa Jokinen Apr 09 '15 at 14:12
  • instead of -e just use -l - you want to List the contents not Edit them – roeb Jul 15 '19 at 11:54
1

Ran into something similar while working on a raspberry pi and I learned that there is a big difference between: 

crontab -e

and 

sudo crontab -e

try checking the later even if you think you are already in an elevated session.

George
  • 111
  • 3
0

when you know the pid, take a look at /proc/<pid>, perhaps you get some useful info there.

Christian
  • 4,645
  • 2
  • 23
  • 27
  • As mentioned, I used lsof on the pid of cron to see if it had something open that might give me a hint, but no luck. I think it reads the crontabs on startup and only again on HUP, so it's hard to get a "live" look. –  Jan 18 '10 at 06:22