Crontab rolling back

[rmueller58]

Crontab rolling back.
question root cron rollbacked to some unknown file this weekend. not sure what the hell is going on
I vi'd /var/tmp/root.cron last week

changed one parameter
read the file in with
crontab /var/tmp/root.cron


We reboot daily and run a backup daily upon system coming up.

Correct -------
30 23 * * * /pei/peitools/bin/reboot.sh
55 23 * * * /pei/peitools/bin/backups.sh

When we came in this morning, backups/exports had not run, and crontab -l output looked like this:

30 23 * * * /pei/peitools/bin/reboot.sh
55 23 * * 1-5 /pei/peitools/bin/backups.sh

Needless to say, I am a wee bit baffled and need to some info from the gurus. Any thoughts from you guys you all can pass along?

[Steven E. Protter · Accepted solution]

Somewhere else in cron, or from a file on another server with rights, a job is running.

This job is either changing cron, or overlaying the actual cron data files with old output.

If you carefully study your job flow you will probably find a job doing. It could of course be another admin, but I've seen my sugestion happen enough times on the ITRC.

SEP

[Alan Meyer_4]

If I'm not mistaken, crontab -l usually reads from the /var/spool/cron/crontabs/root file.

[Bill Hassell]

Assuming a normal system with normal permissions, only a root user can perform such a change. Start by polling anyone that knows the root password. There is nothing in HP-UX that will change crontab entries, only the crontab command can replace the current descriptions. Also look at root's .sh_history to see what's been recorded.

[rmueller58]

Thanks guys, There aren't too many hands in the "cookie jar" that would muck with cron.. I have reviewed the files mentions and will see if it blows up tonight.