Cron Dies Sporadically

[NMory]

Hello All:

My problem is that cron daemon is dying sporadically, so I need to know what is killing it. No errors or messages in syslog or cron log. I need to know if someone has some sort of script that captures what process is killing cron daemon. Already tried tusc, but tusc doesn't log who kills the daemon (did a test on another server). Any input will be appreciated. Maybe a script will be useful!
;-)

Thanks.

[Steven E. Protter · Accepted solution]

Shalom,

grep the keyboard logs for kill statements.

Problem here is that only root can do the kill. Try to kill it from an non privileged user and it should fail.

Scan your system for security holes like root shell or commands with SUID set.

What is the OS/Patch level here?

There may be a need for a cron patch or a bi-annual QPK/Gold Pack

SEP

[NMory]

Yeah, the cron patch is not the latest, but we would like to determine what is causing the kill before attempting a patch install.

[Tingli]

Will the lack of memory cause the problem?

[NMory]

No, we have enough free memory, and system is not swapping that much.

I was thinking on creating a script that involves the usage of the kill command, like modifying it, so whenever a process tries to use the kill command something is logged in a file.

[James R. Ferguson]

Hi:

> Yeah, the cron patch is not the latest, but we would like to determine what is causing the kill before attempting a patch install.

I suggest you read the patch NOTES for your release level to see if any fixes describe your problem! You can view the patch notes via the ITRC Patch Database by simply selecting the patch.

Regards!

...JRF...

[NMory]

Well that's another reason, why we haven't gone with the patch installation, because the description of the patch doesn't mentioned anything about the scenario we are encountering.... So look I have the following script:

# mv /usr/bin/kill /usr/bin/kill.old
# cd /usr/bin
# vi kill


#!/sbin/sh
echo "***" >> /kill.test
echo "Process $$ called /usr/bin/kill" >> /kill.test
ps -ef | sort >> /kill.test
ps -ef | grep $$ >> /kill.test
/usr/bin/kill.orig â $@â

I am able to log to the kill.test file who kills the cron daemon, but only when someone or something uses the full pathed kill command /usr/bin/kill, how can I make this work also if someone uses the regular kill command, just like # kill , example a person that kills the daemon intentionally?

[James R. Ferguson]

Hi (again):

> how can I make this work also if someone uses the regular kill command

You probably just did. You replaced '/usr/bin/kill' with a wrapper. That eliminates shell command use but doesn't stop C-code or Perl code from issuing the system call 'kill()'.

Since the 'cron' daemon shouldn't be killable except by 'root' (uid=0 or euid=0) you have to rule out 'setuid' executables too if you want to assume that this is malicious.

Regards!

...JRF...

[NMory]

I was able to use the kill command (without the full path) and log something to the file, but using an alias of kill=/usr/bin/kill, but obviously is not preserved if another window is open and I retry the kill (without the full path)...so not sure :-(

[Dennis Handly]

>cron daemon is dying sporadically, so I need to know what is killing it.

Any core files hanging around?
One user found that a bogus TZ setting would abort cron.
But this was logged in /var/adm/cron/log.