topic Re: Crontab rolling back in Operating System - HP-UX

Crontab rolling back

rmueller58 — Mon, 19 Sep 2005 09:47:02 GMT

Crontab rolling back.
question root cron rollbacked to some unknown file this weekend. not sure what the hell is going on
I vi'd /var/tmp/root.cron last week

changed one parameter
read the file in with
crontab /var/tmp/root.cron

We reboot daily and run a backup daily upon system coming up.

Correct -------
30 23 * * * /pei/peitools/bin/reboot.sh
55 23 * * * /pei/peitools/bin/backups.sh

When we came in this morning, backups/exports had not run, and crontab -l output looked like this:

30 23 * * * /pei/peitools/bin/reboot.sh
55 23 * * 1-5 /pei/peitools/bin/backups.sh

Needless to say, I am a wee bit baffled and need to some info from the gurus. Any thoughts from you guys you all can pass along?

Re: Crontab rolling back

Steven E. Protter — Mon, 19 Sep 2005 09:49:30 GMT

Somewhere else in cron, or from a file on another server with rights, a job is running.

This job is either changing cron, or overlaying the actual cron data files with old output.

If you carefully study your job flow you will probably find a job doing. It could of course be another admin, but I've seen my sugestion happen enough times on the ITRC.

SEP

Re: Crontab rolling back

Alan Meyer_4 — Mon, 19 Sep 2005 09:50:30 GMT

If I'm not mistaken, crontab -l usually reads from the /var/spool/cron/crontabs/root file.

Re: Crontab rolling back

Bill Hassell — Mon, 19 Sep 2005 09:52:21 GMT

Assuming a normal system with normal permissions, only a root user can perform such a change. Start by polling anyone that knows the root password. There is nothing in HP-UX that will change crontab entries, only the crontab command can replace the current descriptions. Also look at root's .sh_history to see what's been recorded.

Re: Crontab rolling back

rmueller58 — Mon, 19 Sep 2005 10:07:56 GMT

Thanks guys, There aren't too many hands in the "cookie jar" that would muck with cron.. I have reviewed the files mentions and will see if it blows up tonight.