I ran crontab -r instead of crontab -e and deleted my crontab file. I didn't have a backup and new to recover the deleted file.
Is this possible?
Thanks,
Peter
I ran crontab -r instead of crontab -e and deleted my crontab file. I didn't have a backup and new to recover the deleted file.
Is this possible?
Thanks,
Peter
Try looking at /var/log/cron to see what has been running and then try to recreate the crontab from that. Its messy but you should be able to restore everything that had previously run. Not so much luck for newer items though. Good luck!
First of all: Always make backups!
But, it is so easy to mix up crontab -r
and crontab -e
. I just did this myself.
That's what I did:
You can try to have a look at /var/log/cron and build your crontab again.
grep commandname1 /var/log/cron
cat /var/log/cron | grep -v commandname1
. This will exclude the command1 that you already covered.cat /var/log/cron | grep -v commandname1 | grep -v commandname2
Now you should also execute the grep on older cronlogs to find out jobs that might be run only once in a month.
/var/log/syslog/*
.
Apr 12, 2015 at 15:23
I made a PHP script that does a full recovery of your crontab, based on the log.
It outputs a single instance of every cron command run by the user for the last week.
I put it here
https://github.com/dangreenisrael/recover_crontab
Here is a sample output:
perl ~/sorttv/sorttv.pl
/usr/local/bin/flexget
bash ~/scripts/sort_sports.sh
~/scripts/play_recently_added.sh
zgrep -F "($USER) CMD (" /var/log/syslog* | cut -d\( -f3- | sort -u | while read cmd ; do echo ${cmd::-1} ; done
Nov 28, 2018 at 15:54
Ugh can't post a comment on the original question, but a co-worker just showed me a great tool: make an alias in whatever .profile
you use for crontab
to be crontab -i
. The -i
flag asks for confirmation before deleting.
So, if you do crontab -e
it will proceed to edit as usual, but if you accidentally do crontab -r
you are greeted with a confirmation prompt.
You've got options, but none are particularly pretty. In case you haven't thought of it, if you've got a recent version on a development machine, you can copy it from there ... I only say that because I often forget about copies that may be on other machines, so I assume that you've already tried that.
If your file is too heavily customized to make simply rebuilding it practical, you can always try some low-level forensics. Try googling for tutorials based around sleuthkit and UFS Explorer. People using these tools find widely varying degrees in terms of ease of use and success rates, so as usual, YMMV.
I don't think so. It's time to start to backup this important file (with all others in /etc /var/spool /home...).