2

I have a problem, some user ,and I'm not sure who, on one of my servers wrote a cronjob that executes every night at midnight. The cronjob creates a sql dump of a database which is then grabbed by another server and gzipped.

The problem that I'm experiencing is that once that has occurred the file on the local system is no longer needed and I'd like to remove it in an hour or so. Which in, and of itself is not an issue but I don't know where to go to find the crontab for the person in question. Can anyone think of a way to find the cronjob from all the potential places that one could store a cronjob?

Mark D
  • 1,155
  • 2
  • 13
  • 29
  • 1
    If you know the approximate time you could search for it in `/var/log/cron`. My `cron` logs both the crontab file and the user who scheduled the job. – manatwork Sep 15 '11 at 15:25
  • I would but /var/log/cron doesn't seem to exist. – Mark D Sep 15 '11 at 15:56
  • Then see what `/etc/syslog.conf` (the actual name may slightly vary on the syslog implementation; the `rsyslog` I have uses `rsyslog.conf`) says about where `cron` logs. On some systems it goes to `/var/log/messages`. – manatwork Sep 15 '11 at 15:58
  • 1
    @Mark D, check out http://unix.stackexchange.com/questions/7053/how-can-get-a-list-of-all-scheduled-cron-jobs-on-my-machine/7060#7060 which lists several locations to look for crontabs of users – maxschlepzig Sep 15 '11 at 18:10
  • 1
    @Mark, what OS are you working on? – glenn jackman Sep 15 '11 at 18:28
  • Debian 6.0. Personally I'm starting to think that another machine maybe executing a cron job that connects to this machine and dumps the database. – Mark D Sep 19 '11 at 14:20

1 Answers1

3

On solaris at least, look in /var/spool/cron/crontabs

glenn jackman
  • 84,176
  • 15
  • 116
  • 168