- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- Re: Cron Dies Sporadically
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-26-2009 11:31 AM
тАО08-26-2009 11:31 AM
My problem is that cron daemon is dying sporadically, so I need to know what is killing it. No errors or messages in syslog or cron log. I need to know if someone has some sort of script that captures what process is killing cron daemon. Already tried tusc, but tusc doesn't log who kills the daemon (did a test on another server). Any input will be appreciated. Maybe a script will be useful!
;-)
Thanks.
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-26-2009 11:52 AM
тАО08-26-2009 11:52 AM
Solutiongrep the keyboard logs for kill statements.
Problem here is that only root can do the kill. Try to kill it from an non privileged user and it should fail.
Scan your system for security holes like root shell or commands with SUID set.
What is the OS/Patch level here?
There may be a need for a cron patch or a bi-annual QPK/Gold Pack
SEP
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-26-2009 11:53 AM
тАО08-26-2009 11:53 AM
Re: Cron Dies Sporadically
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-26-2009 11:57 AM
тАО08-26-2009 11:57 AM
Re: Cron Dies Sporadically
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-26-2009 12:00 PM
тАО08-26-2009 12:00 PM
Re: Cron Dies Sporadically
I was thinking on creating a script that involves the usage of the kill command, like modifying it, so whenever a process tries to use the kill command something is logged in a file.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-26-2009 12:01 PM
тАО08-26-2009 12:01 PM
Re: Cron Dies Sporadically
> Yeah, the cron patch is not the latest, but we would like to determine what is causing the kill before attempting a patch install.
I suggest you read the patch NOTES for your release level to see if any fixes describe your problem! You can view the patch notes via the ITRC Patch Database by simply selecting the patch.
Regards!
...JRF...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-26-2009 12:13 PM
тАО08-26-2009 12:13 PM
Re: Cron Dies Sporadically
# mv /usr/bin/kill /usr/bin/kill.old
# cd /usr/bin
# vi kill
#!/sbin/sh
echo "***" >> /kill.test
echo "Process $$ called /usr/bin/kill" >> /kill.test
ps -ef | sort >> /kill.test
ps -ef | grep $$ >> /kill.test
/usr/bin/kill.orig ├в $@├в
I am able to log to the kill.test file who kills the cron daemon, but only when someone or something uses the full pathed kill command /usr/bin/kill, how can I make this work also if someone uses the regular kill command, just like # kill
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-26-2009 12:26 PM
тАО08-26-2009 12:26 PM
Re: Cron Dies Sporadically
> how can I make this work also if someone uses the regular kill command
You probably just did. You replaced '/usr/bin/kill' with a wrapper. That eliminates shell command use but doesn't stop C-code or Perl code from issuing the system call 'kill()'.
Since the 'cron' daemon shouldn't be killable except by 'root' (uid=0 or euid=0) you have to rule out 'setuid' executables too if you want to assume that this is malicious.
Regards!
...JRF...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-26-2009 12:39 PM
тАО08-26-2009 12:39 PM
Re: Cron Dies Sporadically
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО08-27-2009 12:28 AM
тАО08-27-2009 12:28 AM
Re: Cron Dies Sporadically
Any core files hanging around?
One user found that a bogus TZ setting would abort cron.
But this was logged in /var/adm/cron/log.