Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I ran crontab -r instead of crontab -e and deleted my crontab file. I didn't have a backup and new to recover the deleted file.

Is this possible?

Thanks,

Peter

share|improve this question
6  
the options to edit and remove shouldn't be right next to each other on the keyboard. Too easy a mistake to make for a quick typer. –  einstiien Feb 4 '10 at 18:42
    
that's exactly what happened to me. –  Peter Feb 4 '10 at 18:46
add comment

6 Answers

Try looking at /var/log/cron to see what has been running and then try to recreate the crontab from that. Its messy but you should be able to restore everything that had previously run. Not so much luck for newer items though. Good luck!

share|improve this answer
    
Great approach! –  Alex Apr 5 '12 at 23:27
add comment

First of all: Always make backups!

But, it is so easy to mix up crontab -r and crontab -e. I just did this myself.

That's what I did:

You can try to have a look at /var/log/cron and build your crontab again.

  1. Have a look at the logfile
  2. Take the first command and do grep commandname1 /var/log/cron
  3. Figure out the systematic behind the times the command was run
  4. Put that entry to your new crontab
  5. execute cat /var/log/cron | grep -v commandname1. This will exclude the command1 that you already covered.
  6. Take the next command and grep for it
  7. Figure out the systematic behind the times the second command was run
  8. put that entry to your new crontab
  9. execute cat /var/log/cron | grep -v commandname1 | grep -v commandname2
  10. Repeat until you covered all commands

Now you should also execute the grep on older cronlogs to find out jobs that might be run only once in a month.

share|improve this answer
add comment

You've got options, but none are particularly pretty. In case you haven't thought of it, if you've got a recent version on a development machine, you can copy it from there ... I only say that because I often forget about copies that may be on other machines, so I assume that you've already tried that.

If your file is too heavily customized to make simply rebuilding it practical, you can always try some low-level forensics. Try googling for tutorials based around sleuthkit and UFS Explorer. People using these tools find widely varying degrees in terms of ease of use and success rates, so as usual, YMMV.

share|improve this answer
add comment

I don't think so. It's time to start to backup this important file (with all others in /etc /var/spool /home...).

share|improve this answer
add comment

Ugh can't post a comment on the original question, but a co-worker just showed me a great tool: make an alias in whatever .profile you use for crontab to be crontab -i. The -i flag asks for confirmation before deleting.

So, if you do crontab -e it will proceed to edit as usual, but if you accidentally do crontab -r you are greeted with a confirmation prompt.

share|improve this answer
    
That doesn't help with the immediate problem... –  vonbrand Apr 10 '13 at 19:15
add comment

Script for full crontab recovery

I made a PHP script that does a full recovery of your crontab, based on the log.

It outputs a single instance of every cron command run by the user for the last week.

I put it here

https://github.com/dangreenisrael/recover_crontab

Here is a sample output:

perl ~/sorttv/sorttv.pl

/usr/local/bin/flexget

bash ~/scripts/sort_sports.sh

~/scripts/play_recently_added.sh
share|improve this answer
    
Why was this given -1? It's a direct answer to the question. –  Dan Green Jul 16 '13 at 11:31
add comment

protected by MadHatter Apr 10 '13 at 20:11

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?