crontab entry erased

[sherinchandy]

Hi

Hi all,

I have an N-Class box running B11.11
After a reboot the crontab entry for oracle got errased I mean the file size was zero bytes(/var/spool/cron/crontabs)nothing was there in the file

can anybody explain what could be the reason

regds

S Chandy

[Jov]

Hi,

Can you confirm there were cron jobs for Oracle before the reboot?


Jov

[Steven E. Protter]

Shalom,

This can happen if the box crashed/rebooted during editing or if /var got full.

Check the underlying hardware on the /var filesystem.

SEP

[sherinchandy]

Hi

there might be cron jobs before reboot most probably

and server rebooted after patching

[Jov]

Hi,

Can you verify this with the timestamp on the oracle user cron spool file?

If timestamp is older than reboot, then its unlikely due to the reboot.


Jov

[sherinchandy]

Time stamp was of reboot

[Jov]

Can you let us know what patch was applied? There might be a patch that touched updated cron and related files, but might be buggy.

Was other crontabs affected?


Jov

[sherinchandy]

Patches applied are ISRM OS security patches
only one users (oracle's)crontab got erased

[A. Clay Stephenson]

I would bet money that what actually happened was something like this:
crontab
rather than:
crontab -l

The command waited until an EOF was received and then dutifully wrote a null crontab for the effective user.

The effect would be exactly the same if someone edited the crontab file directly and nulled the file. Unlike the first case, you wouldn't even know it had been done until the system were rebooted because the cron daemons in-memory image would be intact.

An easy way to determine if the problem was in any way related to the reboot would be to examine your backups. If the files on backup are null then the damage was done before the reboot.

[Patrick Wallek]

A users crontab should not get erased because of a reboot. Have a look through /etc/rc.log.old (shutdown messages) and /etc/rc.log (bootup messages) and see if there is anything in either of those are cron and/or crontab files.

You should find the entries for cron shutdown and startup, but that should be all. Any other cron/crontab entries are not normal.

[sherinchandy]

crontab has been restored from backup only so
erase happened while reboot only.

Nothing specific could be find from rc.log

but after patching its has updated cron also while software configuration phase.

Configuring all unconfigured software filesets
Output from "/sbin/rc2.d/S120swconfig start":
----------------------------
* The following files, which could not be closed by swinstall when they
were updated, are being removed now:
/usr/lib/#libfmtbtlan.1

/usr/lib/sw/lib/#libcma.2
/usr/sbin/#lpsched
/usr/sbin/#cron
/usr/lib/#libnss_dns.1
/usr/sbin/#inetd

[Jov]

That still does not prove it erased the cron files under /var/spool.

Do you have the patch id related to the cron update.


Jov