How can cron start itself?

[Raynald Boucher]

Hello all,
First time I ever seen this on one of our Linux support servers.

$ ps -ef | grep cron
root 1991 1 0 2007 ? 00:00:15 crond
root 31933 1991 0 Jun24 ? 00:00:00 crond
boucherr 18032 17842 0 11:45 pts/1 00:00:00 grep cron

What could trigger cron to start itself?
Which log can I check to see when/how/why the second cron deamon was started?

[Steven E. Protter]

Shalom,

Your system already auto starts cron with a softlink in /sbin/rc3.d or /sbin/rc2.d that points to /sbin/init.d/crond (or cron)

You can write yourself a script that does this, but cron can't be used to start itself.

SEP

[Raynald Boucher]

I agree, but in the "ps" output I supplied, the Jun 24th "crond" process has another "crond" as parent pid.

I'm trying to find out how it happenned.

Stopping "cron" using the init.d script stopped the 1991 process but not the other.

RayB

[Matti_Kurkela · Accepted solution]

In any unix-like system, new processes are normally created by fork() and exec() system calls.

For example, when cron starts up a new process, it essentially branches off a copy of itself, then the copy replaces itself with whatever this particular cron job is supposed to be running.

It's possible that you simply caught cron "in the act" of forking itself. But the start time of the process 31933 is shown as "Jun24" i.e. a date, not a time. This indicates the process is older than 24 hours, so something has prevented the child-cron from performing the exec() syscall.

A NFS access problem at exactly the wrong moment might stop the exec() syscall and leave the child-cron in this state. A disk that's abruptly died or stuck in an infinite-retry loop might have similar results, if the disk is local.

Try getting some more facts. Look into /var/adm/cron/log to find out what was the command cron was trying to execute. When you find the line that refers to process number 31933 and has the correct date, look at the _previous_ line (it should begin with "CMD:") for the command line. Then find out on which disk the command was located and examine the health of that disk.

Also check the syslog and the dmesg listing. If the server is critically low on memory, it sometimes causes things to fail in non-obvious ways.

MK

[Raynald Boucher]

Thanks Matti.

I couldn't find process 31933 in the /var/log/cron but found 31934 which checks on other systems being up at a time when we were experiencing network hiccups.

I'll pass this thread on to my coworkers so they know what to do next time this happens.

Take care all

RayB

[Kaps_2]

If you are using Red Hat Linux you can stop cron by the following command:

# service crond stop

and to stop cron in all runlevel you can use the following command:

#chkconfig crond off

So after the reboot also cron will be in a stoped state.