HPE Community read-only access December 15, 2018
This is a maintenance upgrade. You will be able to read articles and posts, but not post or reply.
Hours:
Dec 15, 4:00 am to 10:00 am UTC
Dec 14, 10:00 pm CST to Dec 15, 4:00 am CST
Dec 14, 8:00 pm PST to Dec 15, 2:00 am PST
cancel
Showing results for 
Search instead for 
Did you mean: 

Cron Dies Sporadically

 
SOLVED
Go to solution
NMory
Respected Contributor

Cron Dies Sporadically

Hello All:

My problem is that cron daemon is dying sporadically, so I need to know what is killing it. No errors or messages in syslog or cron log. I need to know if someone has some sort of script that captures what process is killing cron daemon. Already tried tusc, but tusc doesn't log who kills the daemon (did a test on another server). Any input will be appreciated. Maybe a script will be useful!
;-)

Thanks.
9 REPLIES
Steven E. Protter
Exalted Contributor
Solution

Re: Cron Dies Sporadically

Shalom,

grep the keyboard logs for kill statements.

Problem here is that only root can do the kill. Try to kill it from an non privileged user and it should fail.

Scan your system for security holes like root shell or commands with SUID set.

What is the OS/Patch level here?

There may be a need for a cron patch or a bi-annual QPK/Gold Pack

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
NMory
Respected Contributor

Re: Cron Dies Sporadically

Yeah, the cron patch is not the latest, but we would like to determine what is causing the kill before attempting a patch install.
Tingli
Esteemed Contributor

Re: Cron Dies Sporadically

Will the lack of memory cause the problem?
NMory
Respected Contributor

Re: Cron Dies Sporadically

No, we have enough free memory, and system is not swapping that much.

I was thinking on creating a script that involves the usage of the kill command, like modifying it, so whenever a process tries to use the kill command something is logged in a file.
James R. Ferguson
Acclaimed Contributor

Re: Cron Dies Sporadically

Hi:

> Yeah, the cron patch is not the latest, but we would like to determine what is causing the kill before attempting a patch install.

I suggest you read the patch NOTES for your release level to see if any fixes describe your problem! You can view the patch notes via the ITRC Patch Database by simply selecting the patch.

Regards!

...JRF...
NMory
Respected Contributor

Re: Cron Dies Sporadically

Well that's another reason, why we haven't gone with the patch installation, because the description of the patch doesn't mentioned anything about the scenario we are encountering.... So look I have the following script:

# mv /usr/bin/kill /usr/bin/kill.old
# cd /usr/bin
# vi kill


#!/sbin/sh
echo "***" >> /kill.test
echo "Process $$ called /usr/bin/kill" >> /kill.test
ps -ef | sort >> /kill.test
ps -ef | grep $$ >> /kill.test
/usr/bin/kill.orig â $@â

I am able to log to the kill.test file who kills the cron daemon, but only when someone or something uses the full pathed kill command /usr/bin/kill, how can I make this work also if someone uses the regular kill command, just like # kill , example a person that kills the daemon intentionally?
James R. Ferguson
Acclaimed Contributor

Re: Cron Dies Sporadically

Hi (again):

> how can I make this work also if someone uses the regular kill command

You probably just did. You replaced '/usr/bin/kill' with a wrapper. That eliminates shell command use but doesn't stop C-code or Perl code from issuing the system call 'kill()'.

Since the 'cron' daemon shouldn't be killable except by 'root' (uid=0 or euid=0) you have to rule out 'setuid' executables too if you want to assume that this is malicious.

Regards!

...JRF...
NMory
Respected Contributor

Re: Cron Dies Sporadically

I was able to use the kill command (without the full path) and log something to the file, but using an alias of kill=/usr/bin/kill, but obviously is not preserved if another window is open and I retry the kill (without the full path)...so not sure :-(

Re: Cron Dies Sporadically

>cron daemon is dying sporadically, so I need to know what is killing it.

Any core files hanging around?
One user found that a bogus TZ setting would abort cron.
But this was logged in /var/adm/cron/log.