102

I have a script being run automatically that I can't find in the crontab for the expected users, so I'd like to search all users' crontabs for it.

Essentially I want to run a crontab -l for all users.

Highly Irregular
  • 2,455
  • 6
  • 23
  • 24

6 Answers6

155

Well depends on the script but easily you can find your crontab as root with

crontab -l -u <user>

Or you can find crontab from spool where is located file for all users

cat /var/spool/cron/crontabs/<user>

To show all users' crontabs with the username printed at the beginning of each line:

cd /var/spool/cron/crontabs/ && grep . *
Gilles 'SO- stop being evil'
  • 807,993
  • 194
  • 1,674
  • 2,175
klerk
  • 2,779
  • 2
  • 16
  • 15
24

One liner which lists all users and prints cron for every user:

for user in $(getent passwd | cut -f1 -d: ); do echo $user; crontab -u $user -l; done

This solution:

  • Doesn't require knowing a system specific crontab path (e.g. /var/spool/cron/crontabs/ vs /var/spool/cron/
  • Won't list "orphan" crons, i.e. crons for users that don't exist anymore (and thus are not executed effectively)
Jakub Kukul
  • 341
  • 2
  • 5
1
for USER in `cat /etc/passwd | awk -F ":" '{print $1}'`
do
  echo "this crontab for user : $USER"
  crontab -u $USER -l 2>&1
done >> list_all_cron

Strange need to escape chars on this web site. I think copy paste won't work

Well you got the point : loop all users from /etc/passwd + awk and ask for crontab with crontab -u -l

AdminBee
  • 21,637
  • 21
  • 47
  • 71
pintz
  • 11
  • 1
  • Welcome to the site, and thank you for your contribution. Indeed the backtick is used for in-line comment formatting, making it difficult to use. Still, please note that the backtick format is [deprecated](https://unix.stackexchange.com/questions/126927/have-backticks-i-e-cmd-in-sh-shells-been-deprecated) anyway for command substitutions, and the `$( ... )` format should be used instead. Also, you don't really need to `cat` a file into `awk`, just give the file to be read as parameter after the command. – AdminBee Jun 04 '20 at 11:24
1

To filter out comments from only active user crontabs:

for user in $(getent passwd | cut -f1 -d: ); do echo $user; crontab -u $user -l | grep -v "^#"; done

or quick and dirty from both common directories:

grep -v "^#" /var/spool/cron/crontabs/* /var/spool/cron/*
dgulino
  • 11
  • 1
  • Sorry, just tried these out in ubuntu. First one you need to be root first (`sudo -i`) (you can prob modify the one liner to run the crontab commmand as root). I generally don't like been in a shell as root so I haven't tried this as root to see if it even works, Second one also needs to be run as sudo, so you may want to add that in – Rqomey Dec 08 '20 at 09:58
  • While I agree, one should use sudo instead of logging in as root, the question posted starts with 'as root', and all other answers up to this point have assumed root, so I continued that assumption. – dgulino Dec 08 '20 at 14:51
0

In RHEL/OEL you can list the cron jobs created by all users:

#cd /var/spool/cron/
#ls -1
root
oracle
user1

To see root's cronjobs:

#cat root
Stephen Kitt
  • 411,918
  • 54
  • 1,065
  • 1,164
Vivek B.S.
  • 1
  • The crontab(1) interface (command) should be used, as it protects against concurrent editing of the crontab database. – Dirk Jan 10 '18 at 00:07
0

Using the following command, we findall Cron jobs, on the specified system.

find /etc/cron* -type f -perm -o+w -exec ls -l {} \;
Boschko
  • 280
  • 3
  • 11