Cron job still running when deleted

Question

On a server I inherited, there is a cron job running hourly on one of the Debian servers. It sends an email out to a non-existent email, but bounces back to my account since I listed myself as the root email in /etc/aliases. The cron job has been deleted from /etc/cron.hourly (it was ntupdate), as it's listed in the email. I reloaded the crontab daemon, but I am still getting hourly reports that the file failed to launch, and the email address does not exist!

The output that is getting emailed:

/etc/cron.hourly/ntpdate:
run-parts: failed to exec /etc/cron.hourly/ntpdate: Exec format error
run-parts: /etc/cron.hourly/ntpdate exited with return code 1

Currently, there is just the .placeholder hidden file in /etc/cron.hourly. I also ran crontab -l, and the only 3 jobs listed are expected to be listed, and are running about 10 minutes after this email keep arriving; so I know it is not one of those. Where can I look next to stop getting these emails?

EDIT #1

# ls -l /var/spool/cron
total 4
drwx-wx--T 2 root crontab 4096 Jan 25  2012 crontabs

EDIT #2

# ls -l /var/spool/cron/crontabs/
total 4
-rw------- 1 root crontab 311 Jan 25  2012 root
# more /var/spool/cron/crontabs/root
# DO NOT EDIT THIS FILE - edit the master and reinstall.
# (/tmp/crontab.4nUf85/crontab installed on Wed Jan 25 10:11:10 2012)
# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)
2 1 * * * /etc/webmin/cron/tempdelete.pl
0 22 * * * /etc/init.d/gnugk stop
0 23 * * * /etc/init.d/gnugk start

This is on Debian Squeeze, using just cron, as far as I can tell

What distribution is this (I assume you are on Linux)? Which cron? There are differences between the implementations on different distros. How did you reload the `cron` daemon? Is rebooting the server an option? — terdon, Jul 31 '13 at 19:13
Are these emails really coming from that server? Are they recent? — sendmoreinfo, Jul 31 '13 at 19:16
@sendmoreinfo Yes, they are coming from the root@*servername* account. They are happening at 29 minutes past the hour, every hour — Canadian Luke, Jul 31 '13 at 19:25
@terdon Yes. Just did it again, even though there weren't any changes — Canadian Luke, Jul 31 '13 at 19:28
Maybe you have multiple crons running? `killall -TERM cron && service cron restart`. Then my next port of call would be a more brute force search `grep -r ntpdate /etc/cron*`. — Drav Sloan, Jul 31 '13 at 19:40
Is that time for e-mail reception or sending? Just wondering if the cron has already stopped but you are still receiving a backlog of failure e-mails. — Paulo Almeida, Jul 31 '13 at 19:40
Cannot find ntupdate anywhere in /etc/cron*. Restarted after killing, waiting — Canadian Luke, Jul 31 '13 at 19:41
@PauloAlmeida You may be on to something... Email is sent at xx:17... So it's taking 12 minutes to fail — Canadian Luke, Jul 31 '13 at 19:43
You said you couldn't find `ntupdate`, but the error message is about `ntpdate`. Was that a typo? — Paulo Almeida, Jul 31 '13 at 19:46
@PauloAlmeida I deleted it yesterday, and I'm still gettign emails today — Canadian Luke, Jul 31 '13 at 20:21
Cron logs what it does in `/var/log/syslog`. What recent log entries do you see there (search for `CRON`)? — Gilles 'SO- stop being evil', Jul 31 '13 at 22:45

slm · Accepted Answer · 2013-07-31T18:50:34.813

5

system crons

Did you look through these files & directories to make sure there isn't a duplicate cronjob present?

/etc/crontab
/etc/cron.hourly/
/etc/cron.d/
/etc/cron.daily/
/etc/cron.hourly/
/etc/cron.monthly/
/etc/cron.weekly/

Also any files present in these directories that's executable will be run. Doesn't matter if it's a .placeholder name or whatever. You can use chmod 644 ... to disable any script that is executable.

user crontabs

Also check the following directory to see if there are any user's that have created their own crontabs:

For example:

$ sudo ls -l /var/spool/cron/
total 0
-rw------- 1 saml root 0 Jun  6 06:43 saml

edited Jul 31 '13 at 18:50

answered Jul 31 '13 at 18:34

slm

363,520
117
767
871

Updated again :) – Canadian Luke Jul 31 '13 at 19:24
@CanadianLuke - does the `syslog` show anything else? `/var/log/syslog`. – slm Jul 31 '13 at 19:28
I see that the restart happened of the CRON service, but nothing after that (`Skipping @reboot jobs -- not system startup)` – Canadian Luke Jul 31 '13 at 19:34
@CanadianLuke - do you have anacron along with cron setup to run? – slm Jul 31 '13 at 19:39
No anacron found – Canadian Luke Jul 31 '13 at 19:40
1

@CanadianLuke - do the emails show that it's running now or are these emails queued up and just getting delivered now? – slm Jul 31 '13 at 19:42
Combined with the comments above, and waiting a full day for the settings to fully apply without rebooting, this did solve it – Canadian Luke Aug 02 '13 at 03:55
when I access those folders I see: "apport apt-compat bsdmainutils cracklib-runtime dpkg google-chrome logrotate man-db mdadm mlocate passwd popularity-contest sysstat update-notifier-common upstart" How do I find and delete the jobs if present? – juan Isaza Jan 08 '21 at 09:28
@juanIsaza - Each item in that directory will be a user's crons. Look in the files to see what's in them. To remove any of these crons you have to become a respective user (`su - `) and then do a `crontab -l` or `crontab -e` as them to see these. LMK if this makes sense. – slm Jan 08 '21 at 12:50

Cron job still running when deleted

1 Answers1

system crons

user crontabs

Linked