6

Some time ago, I set up a cron job to run a script every minute. Since then, I've upgraded the system from ubuntu intrepid to ubuntu karmic. Now the job is failing. I get email about it once a minute.

No problem, right? I can just solve the problem and go on my way. Well, ok, but I don't have time to do that right now, so I just want to shut the job off until I get around to it.

Ok, here's where it gets odd. I can't find the cron job. It's not in the crontab (under /var/spool/cron ) for the user (or any other user). It's not in /etc/crontab. It's not in /etc/cron.d. I've recursively grepped the whole of /etc/ and /var/ for the name of the script. Can't find it.

I've run lsof on the pid of the cron to see if it has some weird location I'm unfamiliar with open, no go.

What am I missing here? The job is running. It's being run by cron (Email comes from cron - I can see it in the system logs running under cron), but it doesn't appear to exist anywhere.

Improve this question

6 Answers 6

Reset to default
8

On my Debian system, /var/log/syslog contains an entry for each cron job which is executed …

Jan 17 20:10:01 machine1 /USR/SBIN/CRON[1545]: (convict) CMD (fetchmail -s >/dev/null 2>&1)
Jan 17 20:17:01 machine1 /USR/SBIN/CRON[1800]: (root) CMD (   cd / && run-parts --report /etc/cron.hourly)
Jan 17 20:20:01 machine1 /USR/SBIN/CRON[1914]: (convict) CMD (fetchmail -s >/dev/null 2>&1)

If your job is being executed by cron, you should find a reference to it in /var/log/syslog.

Improve this answer
3
  • Yep. /var/log/syslog shows it executing, but as you'll notice in the examples you posted, it doesn't give any indication where the job itself is scheduled.
    – user31984
    Jan 18, 2010 at 6:17
  • The log entry does show which user is executing the job. That gives an indication of where to look for the definition of the job. Please show your /var/log/syslog entry so that we can help you further.
    – Convict
    Jan 20, 2010 at 4:12
  • Red hat: /var/log/cron
    – Joe Flynn
    Dec 18, 2012 at 17:15
3

I have some things you can try that might help.

To see the cron jobs on the system, try this:

crontab -l

This is what I get (as I only have one job setup to run):

#CrInfo osascript -e "tell application "iTunes" to updateAllPodcasts"
30  2   *   *   *   osascript -e "tell application "iTunes" to updateAllPodcasts"

That will list the jobs that will run on a scheduled basis.

To list all the running processes on the system and their full filesystem paths type:

ps -xa

You'll get some output like this: (which should make it easier to know where to delete the script that runs your email)

 4968 ??         0:03.24 /Applications/Utilities/Terminal.app/Contents/MacOS/Terminal -psn_0_655520
 6112 ??         0:23.31 /Applications/QuickTime Player.app/Contents/MacOS/QuickTime Player -psn_0_712878
 7203 ??         4:33.38 /Applications/Transmit.app/Contents/MacOS/Transmit -psn_0_946407
 7240 ??         2:56.99 /Applications/Google Chrome.app/Contents/MacOS/Google Chrome -psn_0_975086
 7358 ??         0:00.02 /System/Library/PrivateFrameworks/KerberosHelper.framework/Resources/LKDCHelper
 7369 ??         0:04.72 /usr/sbin/AppleFileServer

There's also a page on IBM's site that might help you out with how to use Cron properly.

That said if your job doesn't appear in cron are you sure you aren't running it with some other tool that you've forgotten about? Some custom deamon application that you may have downloaded for example?

Improve this answer
1
  • As I said in my original post, I can see it running under cron in syslog. It's definitely being run by cron and nothing else. I'm quite familiar with how to operate cron "properly", as you say. The point is, the job does not appear to be scheduled in any of the normal places (or any abnormal ones either).
    – user31984
    Jan 18, 2010 at 6:21
2

It may be in /etc/cron.daily (I assume it runs as root). Those jobs are not visible in crontab -l but still executed.

Improve this answer
2
  • How does a job from /etc/cron.daily run on every minute? ;)
    – Esa Jokinen
    Apr 9, 2015 at 15:06
  • @Esa: Good point :-)
    – dtoubelis
    Apr 9, 2015 at 15:58
1

I know this is 5 years old, but for anyone stumbling across this having the same problem (as I had) here is my solution:

I checked every users crontab with sudo crontab -e -u username Where "username" should be an existing username like "www-data" (which was the culprit in my case).

Hope this helps someone.

Improve this answer
2
  • As other answer on this question states, it is not necessary to go through every account since the information is in system log. However sudo crontab -e -u username is a good addition showing a way to access it. It could be a comment instead of new answer, though.
    – Esa Jokinen
    Apr 9, 2015 at 14:12
  • instead of -e just use -l - you want to List the contents not Edit them
    – roeb
    Jul 15, 2019 at 11:54
1

Ran into something similar while working on a raspberry pi and I learned that there is a big difference between: 

crontab -e

and 

sudo crontab -e

try checking the later even if you think you are already in an elevated session.

Improve this answer
1
  • 1
    Also: if you look in /var/spool/cron/crontabs/ you can see which users have crontabs.
    – chicks
    May 12, 2018 at 17:53
0

when you know the pid, take a look at /proc/<pid>, perhaps you get some useful info there.

Improve this answer
1
  • As mentioned, I used lsof on the pid of cron to see if it had something open that might give me a hint, but no luck. I think it reads the crontabs on startup and only again on HUP, so it's hard to get a "live" look.
    – user31984
    Jan 18, 2010 at 6:22

You must log in to answer this question.