topic Re: crontab entry erased in Operating System - HP-UX

crontab entry erased

sherinchandy — Mon, 28 May 2007 15:53:28 GMT

Hi

Hi all,

I have an N-Class box running B11.11
After a reboot the crontab entry for oracle got errased I mean the file size was zero bytes(/var/spool/cron/crontabs)nothing was there in the file

can anybody explain what could be the reason

regds

S Chandy

Re: crontab entry erased

Jov — Mon, 28 May 2007 16:04:47 GMT

Hi,

Can you confirm there were cron jobs for Oracle before the reboot?

Jov

Re: crontab entry erased

Steven E. Protter — Mon, 28 May 2007 16:24:20 GMT

Shalom,

This can happen if the box crashed/rebooted during editing or if /var got full.

Check the underlying hardware on the /var filesystem.

SEP

Re: crontab entry erased

sherinchandy — Mon, 28 May 2007 17:56:41 GMT

Hi

there might be cron jobs before reboot most probably

and server rebooted after patching

Re: crontab entry erased

Jov — Mon, 28 May 2007 18:04:51 GMT

Hi,

Can you verify this with the timestamp on the oracle user cron spool file?

If timestamp is older than reboot, then its unlikely due to the reboot.

Jov

Re: crontab entry erased

sherinchandy — Mon, 28 May 2007 18:07:30 GMT

Time stamp was of reboot

Re: crontab entry erased

Jov — Mon, 28 May 2007 19:28:14 GMT

Can you let us know what patch was applied? There might be a patch that touched updated cron and related files, but might be buggy.

Was other crontabs affected?

Jov

Re: crontab entry erased

sherinchandy — Tue, 29 May 2007 11:30:25 GMT

Patches applied are ISRM OS security patches
only one users (oracle's)crontab got erased

Re: crontab entry erased

A. Clay Stephenson — Tue, 29 May 2007 11:36:11 GMT

I would bet money that what actually happened was something like this:
crontab
rather than:
crontab -l

The command waited until an EOF was received and then dutifully wrote a null crontab for the effective user.

The effect would be exactly the same if someone edited the crontab file directly and nulled the file. Unlike the first case, you wouldn't even know it had been done until the system were rebooted because the cron daemons in-memory image would be intact.

An easy way to determine if the problem was in any way related to the reboot would be to examine your backups. If the files on backup are null then the damage was done before the reboot.

Re: crontab entry erased

Patrick Wallek — Tue, 29 May 2007 11:37:54 GMT

A users crontab should not get erased because of a reboot. Have a look through /etc/rc.log.old (shutdown messages) and /etc/rc.log (bootup messages) and see if there is anything in either of those are cron and/or crontab files.

You should find the entries for cron shutdown and startup, but that should be all. Any other cron/crontab entries are not normal.

Re: crontab entry erased

sherinchandy — Tue, 29 May 2007 12:04:33 GMT

crontab has been restored from backup only so
erase happened while reboot only.

Nothing specific could be find from rc.log

but after patching its has updated cron also while software configuration phase.

Configuring all unconfigured software filesets
Output from "/sbin/rc2.d/S120swconfig start":
----------------------------
* The following files, which could not be closed by swinstall when they
were updated, are being removed now:
/usr/lib/#libfmtbtlan.1

/usr/lib/sw/lib/#libcma.2
/usr/sbin/#lpsched
/usr/sbin/#cron
/usr/lib/#libnss_dns.1
/usr/sbin/#inetd

Re: crontab entry erased

Jov — Tue, 29 May 2007 12:12:43 GMT

That still does not prove it erased the cron files under /var/spool.

Do you have the patch id related to the cron update.

Jov