I have a rogue cron job that runs every 10 minutes on a Centos system. How do I find all the jobs that are performed?

Question

Thank you for your help

Answer 1

See this question on StackOverflow (How do I list all cron jobs for all users?). The short version is that you could run the following (@Kyle Burton's answer on that question):

for user in $(cut -f1 -d: /etc/passwd); do crontab -u $user -l; done

There is also a more indepth script that you could copy and run on that post.

Answer 2

Or if you're root, just check the directory /var/spool/cron/tabs. In there should be a complete list of all user crons. There are also crons that run out of the /etc/cron* directories. Just run:

# ls -l /etc/cron*
# ls -l /var/spool/cron/tabs/

To see them all.

Answer 3

You could do something like this:

for crontab in `ls /etc/cron.*/* /var/spool/cron/* /etc/crontab`
do
    echo $crontab
    cat $crontab
done

And remember to check the log file /var/log/cron or similar which will list everything that has been run by cron.