I'm running a Debian server on EC2, and a few days ago my crontab definitions suddenly disappeared. Just vanished without provocation!
Any ideas what can be responsible for that? I don't suspect any unauthorized access to the server.
Unfortunately, it's extremely easy to lose a user crontab (and almost as easy when that user is root).
Here are a couple of examples of ways to empty one out:
crontab '' echo $emptyvar | crontab - crontab emptyfile crontab -l | oops | crontab -
oops represents some command that is supposed to manipulate the contents output by
crontab -l before replacing them using
crontab. For some reason ("oops") the contents don't get passed through the pipe.
You should check your scripts and crontabs for any lines that attempt to manipulate root's crontab and make sure they're not doing something wrong.
Also, for user crontabs, when you edit one yourself always use
It could be that the partition where /var is located was full.
If this is happening and /tmp is located in another partition you can edit the temporal file with crontab -e but when you finish the edition the new version can not be copied to /var/spool/cron/ and as result you obtain an empty file.
I know this is a strange case but crontab does not return any error.
Reading about EC2 issues on forums.aws.amazon.com. Not specifically this problem but static data disappearing after reboots. You might want to jump in to some discussions over there or contact aws support. In the mean time I'd script something to backup my crontabs to S3 or something.
See if the crontab file actually exists in /var/spool/cron/crontab/ before you try to edit it. Is it empty or is it being created at that moment?
Has your EC2 instance rebooted?
grep -r crontab /etc/* and see if there's anything touching them.